Log in Start free

Vulnerability · Published Jun 12, 2025 · Assigned by mitre

CVE-2024-44905

Medium 6.5

In plain English

A medium-severity SQL injection in the golang-gopkg-pg.v5 package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 61.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-gopkg-pg.v5no fix listedDEBIAN-CVE-2024-44905
Debian:13golang-gopkg-pg.v5no fix listedDEBIAN-CVE-2024-44905
Gogithub.com/go-pg/pgno fix listedGHSA-6xp3-p59p-q4fj
Gogithub.com/go-pg/pgno fix listedGO-2025-3764
Gogithub.com/go-pg/pg/v1010.15.0GHSA-6xp3-p59p-q4fj
Gogithub.com/go-pg/pg/v1010.15.0GO-2025-3764
Gogithub.com/go-pg/pg/v9no fix listedGO-2025-3764
Gogithub.com/go-pg/pg/v9no fix listedGHSA-6xp3-p59p-q4fj
Ubuntu:22.04:LTSgolang-gopkg-pg.v5no fix listedUBUNTU-CVE-2024-44905
Ubuntu:24.04:LTSgolang-gopkg-pg.v5no fix listedUBUNTU-CVE-2024-44905
Ubuntu:25.10golang-gopkg-pg.v5no fix listedUBUNTU-CVE-2024-44905

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References