HIGH7.5

GHSA-vf99-xw26-86g5

PgHero Allows Information Disclosure Through EXPLAIN Feature

Quick fix

GHSA-vf99-xw26-86g5 — pghero: upgrade to the fixed version with the command below.

bundle update pghero

Details

PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges, this may only be information from the database, or may be information from file contents on the database server.)

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/pghero

Introduced in: 0Fixed in: 3.1.0

Fixbundle update pghero

References

https://nvd.nist.gov/vuln/detail/CVE-2023-22626[ADVISORY]
https://github.com/ankane/pghero/issues/439[WEB]
https://github.com/ankane/pghero[PACKAGE]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pghero/CVE-2023-22626.yml[WEB]