GHSA-vf99-xw26-86g5

PgHero Allows Information Disclosure Through EXPLAIN Feature

Source: GitHub Advisory Database (reviewed) High CVE-2023-22626

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	pghero	< 3.1.0	3.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges, this may only be information from the database, or may be information from file contents on the database server.)

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-22626 advisory
https://github.com/ankane/pghero/issues/439 web
https://github.com/ankane/pghero package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pghero/CVE-2023-22626.yml web