Important: postgresql-jdbc security update
Summary
ALSA-2020:3176: Important: postgresql-jdbc security update. Affects postgresql-jdbc versions < 42.2.3-3.el8_2. Fixed in 42.2.3-3.el8_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.
Vulnerability Detail
The postgresql-jdbc package is affected by an XML external entity (XXE) vulnerability in PgSQLXML (CVE-2020-13692). This vulnerability allows an attacker to exploit XML parsing functionality and potentially access sensitive information or execute arbitrary code. The impact of this vulnerability can be severe, leading to unauthorized access, data leakage, or remote code execution.
How To Fix
Minimum fixed version
42.2.3-3.el8_2
This is the first release that contains the fix.
sudo dnf update postgresql-jdbcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
In conclusion, the postgresql-jdbc package is affected by an XXE vulnerability that can result in unauthorized access, data leakage, or remote code execution. It is crucial to update the package to the recommended version or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql-jdbc →
FAQ
PostgreSQL is an advanced object-relational database management system known for its robustness, extensibility, and compliance with SQL standards.
The postgresql-jdbc package provides the necessary .jar files for Java programs to connect to and interact with a PostgreSQL database.
An XML external entity (XXE) vulnerability is a type of security flaw that allows an attacker to exploit XML parsing functionality and potentially access sensitive information or execute arbitrary code.
The impact of this vulnerability can be severe, leading to unauthorized access, data leakage, or remote code execution.
You can update the postgresql-jdbc package to version 42.2.3-3.el8_2 or later using the package manager of your operating system.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-jdbc.
