Is CVE-2019-11069 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-11069 being exploited in the wild.

How severe is CVE-2019-11069?

Low severity, with a CVSS score of 3, published 11 April 2019.

Which products and versions are affected?

sequelize (npm) SEMVER:introduced=5.0.0,fixed=5.3.0.

Is there a fix for CVE-2019-11069?

Yes. sequelize (npm): upgrade to 5.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-11069 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-11069?

Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-11069: Sequelize SQL injection in PostgreSQL dialect

CVE-2019-11069 · Severity: low · CVSS 3 · Published 2019-04-11

Sequelize is a popular tool used by developers to interact with databases in Node.js applications. A security flaw was found where the library failed to properly configure security settings when connecting to PostgreSQL databases. This could allow an attacker to inject malicious database commands, potentially leading to unauthorized data modification or loss of data integrity.

Technologies: sequelize (npm). Vendors: npm.

Quick answers

Is CVE-2019-11069 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-11069 being exploited in the wild.
How severe is CVE-2019-11069?: Low severity, with a CVSS score of 3, published 11 April 2019.
Which products and versions are affected?: sequelize (npm) SEMVER:introduced=5.0.0,fixed=5.3.0.
Is there a fix for CVE-2019-11069?: Yes. sequelize (npm): upgrade to 5.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-11069 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-11069?: Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

sequelize (npm): upgrade to 5.3.0 or later
```
npm install sequelize@5.3.0
```

Technical details

Sequelize versions 5.x prior to 5.3.0 are vulnerable to SQL injection when interfacing with PostgreSQL. The vulnerability stems from the library not explicitly enabling the 'standard_conforming_strings' PostgreSQL option by default. When this option is disabled, PostgreSQL treats backslashes as escape characters in string literals, which Sequelize's query generator does not properly account for. An attacker can leverage this discrepancy to break out of string literals and inject arbitrary SQL statements. The fix, introduced in version 5.3.0, ensures that 'standard_conforming_strings' is set to 'on' during the connection initialization regardless of the PostgreSQL version.

Affected products

sequelize sequelize >= 5.0.0, < 5.3.0

Identifiers

CVE-2019-11069
GHSA-2777-2vq8-c4v4

Timeline

2019-04-10: patched: Fix merged in pull request 10746
2019-04-10: advisory: NVD published CVE-2019-11069
2019-04-11: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.