Mmastodon TechnologyCybersecurity first seen 18 d ago, last 18 d ago, peak #10

Pgx Go Postgres driver hit by critical CVSS 9.8 flaw

Original: Pgx (Go Postgres driver) carries 3 CVEs but one hits CVSS 9.8 and 66% of installs sit unpatched. Trust score C. Two flaw

Pgx, the widely used Go driver for PostgreSQL, carries three CVEs, one rated CVSS 9.8. Two of the flaws involve SQL injection (CWE-89), and an estimated 66% of installs remain unpatched. A new vendor trust assessment scores pgx at C, and developers are being urged to verify their pgx version before the next deployment.

Why now: A critical unpatched vulnerability in a core Go database driver raises urgent supply-chain and SQL injection concerns for developers

PgxPostgreSQLGoCVE

Open on mastodon →

Evidence

• Pgx (Go Postgres driver) carries 3 CVEs but one hits CVSS 9.8 and 66% of installs sit unpatched. Trust score C. Two flaws trace to CWE-89 SQL injection. Check your pgx version before the next deploy. # cybersecurity # infosec # golang https://www. valtersit.com/vendors/pgx/ · hugovalters

API: https://socialmediatrends-api.osmike.com/v1/trends/3792076