CVE-2022-21724: Vulnerability in postgresql-jdbc-driver
Summary
CVE-2022-21724: Unchecked Class Instantiation when providing Plugin Classes. Affects postgresql-jdbc-driver across 2 version ranges.
< 42.2.25
>= 42.3.0, < 42.3.2
Fixed in 42.2.25 or 42.3.2, depending on the release line you run. How to fix ↓
Also tracked for
- libpgjava · Debian:11
- org.postgresql:postgresql · Maven
The same CVE-2022-21724 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The postgresql-jdbc-driver is the official PostgreSQL JDBC Driver. It provides connectivity between Java applications and PostgreSQL databases. The driver allows users to execute SQL statements, retrieve results, and manage transactions. This vulnerability affects versions 0 to 42.2.25 and 42.3.0 to 42.3.2-rc1 of the driver. It can be exploited when an attacker controls the JDBC URL or properties, leading to code execution loaded via arbitrary classes.
Vulnerability Detail
The vulnerability in the postgresql-jdbc-driver arises from the driver's failure to verify if a class implements the expected interface before instantiating it. This allows an attacker to execute arbitrary code by providing malicious class names via connection properties such as authenticationPluginClassName, sslhostnameverifier, socketFactory, sslfactory, or sslpasswordcallback. As a result, an attacker can compromise the system using the postgresql library. This is a critical vulnerability with a CVSSv3 score of 9.8 (Critical).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 42.2.2542.2.25 -
>= 42.3.0, < 42.3.242.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The postgresql-jdbc-driver is vulnerable to a critical code execution vulnerability. It is crucial to upgrade to the fixed versions to mitigate the risk of exploitation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for postgresql-jdbc-driver →
FAQ
The postgresql-jdbc-driver is the official JDBC driver for connecting Java applications to PostgreSQL databases.
This vulnerability allows an attacker to execute arbitrary code and potentially compromise the system using the postgresql library.
To fix this vulnerability, upgrade to version 42.2.25 or later for versions 0 to 42.2.25, and version 42.3.2 or later for versions 42.3.0 to 42.3.2-rc1.
No, there are no known workarounds for this vulnerability.
This vulnerability is rated as Critical with a CVSSv3 score of 9.8.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-jdbc-driver.
