CVE catalog

CVE-2024-44905

golang-gopkg-pg.v5: CVE-2024-44905

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.44% · Oct 25, 2026

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-gopkg-pg.v5trixie5.3.3-3.1vulnerable
Debiangolang-gopkg-pg.v5bookworm5.3.3-3.1vulnerable
Opensusegovulncheck-vulndbtumbleweed0.0.20250730T213748-1.1fixed
Opensusegovulncheck-vulndbleap 15.60.0.20260123T022811-150000.1.140.1fixed
Opensusegovulncheck-vulndbleap 15.60.0.20251230T014957-150000.1.134.1fixed
Ubuntugolang-gopkg-pg.v518.045.3.3-2vulnerable
Ubuntugolang-gopkg-pg.v520.045.3.3-3vulnerable
Ubuntugolang-gopkg-pg.v522.045.3.3-3.1vulnerable
Ubuntugolang-gopkg-pg.v524.045.3.3-3.1vulnerable
Ubuntugolang-gopkg-pg.v525.105.3.3-3.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-gopkg-pg.v5sourcetrixie(unfixed)not yet assignedNot reported[1111939]
Debiangolang-gopkg-pg.v5sourcebookworm(unfixed)not yet assignedNot reported[1111939]
Opensusegovulncheck-vulndbrpmtumbleweed0.0.20250730T213748-1.1Not reportedOPENSUSE-SU-2025:15405-1Not reported
Opensusegovulncheck-vulndbrpmleap 15.60.0.20260123T022811-150000.1.140.1Not reportedSUSE-SU-2026:0292-1Not reported
Opensusegovulncheck-vulndbrpmleap 15.60.0.20251230T014957-150000.1.134.1Not reportedSUSE-SU-2026:0037-1Not reported

[Debian bug #1111939]

Notes

[trixie] golang-gopkg-pg.v5: Minor issue [bookworm] golang-gopkg-pg.v5: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-gopkg-pg.v5-dev]Affected

    Source package: [golang-gopkg-pg.v5]

    Details (2)

    • 5.3.3-3.1 · all · bookworm

      Affected

      dsa · golang-gopkg-pg.v5 · debian · bookworm; dsa · golang-gopkg-pg.v5 · debian · 12

    • 5.3.3-3.1 · all · bookworm

      Affected

      dsa · golang-gopkg-pg.v5 · debian · bookworm; dsa · golang-gopkg-pg.v5 · debian · 12

[Debian 13 (Trixie)]

  • [golang-gopkg-pg.v5-dev]Affected

    Source package: [golang-gopkg-pg.v5]

    Details (2)

    • 5.3.3-3.1 · all · trixie

      Affected

      dsa · golang-gopkg-pg.v5 · debian · 13

    • 5.3.3-3.1 · all · trixie

      Affected

      dsa · golang-gopkg-pg.v5 · debian · 13

[openSUSE Tumbleweed]

  • [govulncheck-vulndb]Fixed

    Source package: [govulncheck-vulndb]

    Details (1)

    • 0.0.20260828T144745-1.1 · noarch · tumbleweed

      Fixed · Fixed: 0.0.20250730T213748-1.1

      dsa · govulncheck-vulndb · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]