CVE-2022-41946: Vulnerability in postgresql-jdbc-driver
Summary
CVE-2022-41946: TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc. Affects postgresql-jdbc-driver across 4 version ranges.
>= 42.2.0, < 42.2.27
>= 42.3.0, < 42.3.8
>= 42.4.0, < 42.4.3
>= 42.5.0, < 42.5.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- org.postgresql:postgresql · Maven
- libpgjava · Debian:11
The same CVE-2022-41946 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The postgresql-jdbc-driver is an open source JDBC driver for PostgreSQL databases. It provides connectivity between Java applications and PostgreSQL databases, allowing users to execute SQL queries and manage database operations. This vulnerability affects versions of the driver that use prepared statements with the setText(int, InputStream) or setBytea(int, InputStream) methods. When an InputStream larger than 2k is used, a temporary file is created in the system's temporary directory. On Unix-like systems, this temporary directory is shared among all users, making the file readable by other users. However, on MacOS, this vulnerability does not exist as the temporary directory is not shared. This vulnerability only results in information disclosure and does not allow other users to modify or overwrite files or directories. The fix for this vulnerability depends on the version of the JDK being used.
Vulnerability Detail
The vulnerability arises from the creation of a temporary file in the system's temporary directory when using certain methods in the postgresql-jdbc-driver. This file is readable by other users on Unix-like systems, but not on MacOS. The information disclosure does not allow unauthorized modification or overwrite of files or directories. The fix for this vulnerability is dependent on the version of the JDK being used. For Java 1.7 and higher, the vulnerability is fixed in version 4.5.0 of the driver. However, for Java 1.6 and lower, no patch is available. A workaround for users stuck on Java 1.6 is to specify a java.io.tmpdir system environment variable pointing to a directory exclusively owned by the executing user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 42.2.0, < 42.2.2742.2.27 -
>= 42.3.0, < 42.3.842.3.8 -
>= 42.4.0, < 42.4.342.4.3 -
>= 42.5.0, < 42.5.142.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to upgrade the postgresql-jdbc-driver and are stuck on Java 1.6 or lower, you can mitigate the vulnerability by setting the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user. This can be done by adding the following line to your application's startup script or command:
export JAVA_OPTS="-Djava.io.tmpdir=/path/to/exclusive/directory"
Conclusion
The postgresql-jdbc-driver is vulnerable to an information disclosure vulnerability when using certain methods with large InputStreams. This vulnerability allows other users on Unix-like systems to read temporary files created by the driver. However, it does not allow unauthorized modification or overwrite of files or directories. To fix this vulnerability, upgrade to version 4.5.0 of the driver if you are using Java 1.7 or higher. If you are using Java 1.6 or lower and unable to upgrade, mitigate the vulnerability by setting the java.io.tmpdir system environment variable to a directory exclusively owned by the executing user. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for postgresql-jdbc-driver →
FAQ
This vulnerability allows other users on Unix-like systems to read temporary files created by the postgresql-jdbc-driver when using certain methods with large InputStreams. However, it does not allow unauthorized modification or overwrite of files or directories.
No, this vulnerability does not exist on MacOS as the system's temporary directory is not shared among users.
The recommended fix is to upgrade to version 4.5.0 of the postgresql-jdbc-driver if you are using Java 1.7 or higher. If you are using Java 1.6 or lower and unable to upgrade, you can mitigate the vulnerability by setting the java.io.tmpdir system environment variable to a directory exclusively owned by the executing user.
Yes, if you are unable to upgrade the postgresql-jdbc-driver and are stuck on Java 1.6 or lower, you can mitigate the vulnerability by setting the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user.
You can find more information about this vulnerability in the official vulnerability report at: https://github.com/bitnami/vulndb/tree/main/data/postgresql-jdbc-driver/BIT-postgresql-jdbc-driver-2022-41946.json
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-jdbc-driver.
