The following presentation at this year's DEF CON was brought to our attention on the SQLx Discord:

SQL Injection isn't Dead: Smuggling Queries at the Protocol Level
http://web.archive.org/web/20240812130923/https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn't%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf
(Archive link for posterity.)

Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to overflow, causing the server to interpret the rest of the string as binary protocol commands or other data.

It appears SQLx does perform truncating casts in a way that could be problematic, for example: https://github.com/launchbadge/sqlx/blob/6f2905695b9606b5f51b40ce10af63ac9e696bb8/sqlx-postgres/src/arguments.rs#L163

This code has existed essentially since the beginning, so it is reasonable to assume that all published versions <= 0.8.0 are affected.

Mitigation

As always, you should make sure your application is validating untrustworthy user input. Reject any input over 4 GiB, or any input that could encode to a string longer than 4 GiB. Dynamically built queries are also potentially problematic if it pushes the message size over this 4 GiB bound.

Encode::size_hint() can be used for sanity checks, but do not assume that the size returned is accurate. For example, the Json<T> and Text<T> adapters have no reasonable way to predict or estimate the final encoded size, so they just return size_of::<T>() instead.

For web application backends, consider adding some middleware that limits the size of request bodies by default.

Resolution

sqlx 0.8.1 has been released with the fix: https://github.com/launchbadge/sqlx/blob/main/CHANGELOG.md#081---2024-08-23

Postgres users are advised to upgrade ASAP as a possible exploit has been demonstrated: https://github.com/launchbadge/sqlx/issues/3440#issuecomment-2307956901

MySQL and SQLite do not appear to be exploitable, but upgrading is recommended nonetheless.

The Debug implementations of Tls12ClientSessionValue and Tls13ClientSessionValue were derived, and so included the TLS 1.2 master secret or TLS 1.3 resumption PSK in their output.

Custom ClientSessionStore implementations that format these values with Debug (for example, when logging) could disclose these secrets to readers of the logs. This conflicts with rustls's key-material redaction policy.

Ordinary connection and built-in session cache Debug output is redacted and is not affected.

The client recorded the server-selected key exchange group for each server name when processing the ServerHello, before the server was authenticated. This record is used to predict which key share to send in future ClientHellos to that server name.

A network attacker can answer one connection attempt with a ServerHello selecting X25519, and then close the connection. Later ClientHellos for that name carry only an X25519 key share, while supported_groups still lists X25519MLKEM768 first. If the genuine server accepts that share rather than sending a HelloRetryRequest for its preferred hybrid group, the handshake completes with classical-only key exchange and no error. This persists for as long as the entry stays in the client's session store.

The impact is loss of post-quantum confidentiality for affected connections ("harvest now, decrypt later"). There is no key compromise and no authentication bypass.

The following are not affected:

• connections to servers which send a HelloRetryRequest for their preferred group,
• clients with resumption disabled (as nothing is stored), and
• other server names.

This behaviour is discussed in draft-ietf-tls-key-share-prediction, so the practical impact depends largely on server policy.

With DNSSEC validation enabled, Resolver::lookup() and Resolver::lookup_ip() returned Ok with the records even when validation found the response bogus. The result was only visible in each record's proof status, which callers had to inspect themselves.

Applications that enable validation and treat a successful lookup as validated data would therefore accept forged or tampered answers from anyone who can answer or modify their DNS traffic.

From 0.26.2 a lookup whose records are bogus fails with a "DNSSEC validation failed" error (DnsError::DnssecBogus), the error is not retried, and the hickory-server forwarder answers SERVFAIL for it.