chore(deps): update dependency npgsql to 8.0.3 [security] #861
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
✒️ PR Title Commitlint - ✔️ Lint success! |
marvin-serp-bot
force-pushed
the
upgrade/nuget-npgsql-vulnerability
branch
from
a5a1565 to
fc3e173
Compare
marvin-serp-bot
changed the title
marvin-serp-bot
changed the title
marvin-serp-bot
changed the title
marvin-serp-bot
changed the title
marvin-serp-bot
changed the title
marvin-serp-bot
changed the title
marvin-serp-bot
changed the title
marvin-serp-bot
changed the title
marvin-serp-bot
changed the title
marvin-serp-bot
force-pushed
the
upgrade/nuget-npgsql-vulnerability
branch
from
0784384 to
468a062
Compare
marvin-serp-bot
changed the title
marvin-serp-bot
changed the title
marvin-serp-bot
force-pushed
the
upgrade/nuget-npgsql-vulnerability
branch
2 times, most recently
from
b678b77 to
4027f71
Compare
marvin-serp-bot
changed the title
marvin-serp-bot
changed the title
marvin-serp-bot
changed the title
marvin-serp-bot
changed the title
marvin-serp-bot
changed the title
marvin-serp-bot
changed the title
marvin-serp-bot
force-pushed
the
upgrade/nuget-npgsql-vulnerability
branch
from
4027f71 to
d03178a
Compare
marvin-serp-bot
force-pushed
the
upgrade/nuget-npgsql-vulnerability
branch
from
d03178a to
e06fab8
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
8.0.2->8.0.3GitHub Vulnerability Alerts
CVE-2024-32655
Summary
The
WriteBind()method insrc/Npgsql/Internal/NpgsqlConnector.FrontendMessages.csusesintvariables to store the message length and the sum of parameter lengths. Both variables overflow when the sum of parameter lengths becomes too large.This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message.
Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf.
Impact
Attackers can issue arbitrary SQL statements to the database on behalf of the application. The final impact depends on the application that uses Npgsql, the data it stores in Postgres, etc.
Release Notes
npgsql/npgsql (Npgsql)
v8.0.3This version contains a high-severity security patch for CVE-2024-32655 everyone is advised to upgrade.
A large number of number of bugs have been fixed, here is the full list.
Thanks to @paul-gerste-sonarsource for reporting the vulnerability.
Configuration
📅 Schedule: Branch creation - "" in timezone Europe/London, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.