CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NCVE-2024-44905
Medium (6.5) in uptrace pg. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/go-pg/pg/v10 10.15.0.
go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- uptrace:pg
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6xp3-p59p-q4fj | Go | github.com/go-pg/pg/v10 | <10.15.0 | 10.15.0 |
| GHSA-6xp3-p59p-q4fj | Go | github.com/go-pg/pg/v9 | <=9.2.1 | no fix published |
| GHSA-6xp3-p59p-q4fj | Go | github.com/go-pg/pg | <=8.0.7 | no fix published |
| GO-2025-3764 | Go | github.com/go-pg/pg | all versions | no fix published |
| GO-2025-3764 | Go | github.com/go-pg/pg/v9 | all versions | no fix published |
| GO-2025-3764 | Go | github.com/go-pg/pg/v10 | <10.15.0 | 10.15.0 |
References
- https://github.com/go-pg/pg
- https://github.com/go-pg/pg/blob/30e7053c6cacdd44d06cf2b92183b49188b7c922/types/append_value.go#L151
- https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn%27t%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf
- https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw/