CVE-2022-26520: Vulnerability in postgresql-jdbc-driver
Summary
CVE-2022-26520: In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. Affects postgresql-jdbc-driver across 2 version ranges.
>= 42.1.0, < 42.1.5
>= 42.3.0, < 42.3.3
Fixed in 42.1.5 or 42.3.3, depending on the release line you run. How to fix ↓
Also tracked for
- org.postgresql:postgresql · Maven
- libpgjava · Debian:11
The same CVE-2022-26520 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The postgresql-jdbc-driver is a Java database connectivity driver that allows Java programs to connect to a PostgreSQL database. It provides a set of classes and methods to interact with the database, execute SQL queries, and manage database connections. The driver is widely used in various applications and frameworks that require access to PostgreSQL databases.
Vulnerability Detail
The vulnerability (CVE-2022-26520) in the postgresql-jdbc-driver allows an attacker who controls the jdbc URL or properties to call java.util.logging.FileHandler and write to arbitrary files through the loggerFile and loggerLevel connection properties. This can be exploited by an attacker to create executable files, such as JSP files, in a Tomcat web root directory. The vulnerability is not specific to the postgresql-jdbc-driver itself but rather any application that uses the driver with untrusted connection properties.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 42.1.0, < 42.1.542.1.5 -
>= 42.3.0, < 42.3.342.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, it is advised to validate and sanitize the jdbc URL and properties before using them to establish a database connection. This can be done by implementing input validation and filtering mechanisms to ensure that only trusted and safe values are used. Additionally, restricting access to the jdbc URL and properties to trusted sources can help mitigate the risk of exploitation.
Conclusion
In conclusion, the postgresql-jdbc-driver is vulnerable to a file writing vulnerability when untrusted connection properties are used. To mitigate the risk, it is crucial to update to the latest version of the driver and implement input validation and filtering mechanisms. Regularly checking for vulnerabilities using tools like Vulert can help ensure the security of your application.
See every vulnerability recorded for postgresql-jdbc-driver →
FAQ
The vulnerability allows an attacker to write arbitrary files, potentially leading to remote code execution or unauthorized access to sensitive information.
No, the vulnerability is not specific to the driver itself. It affects any application that uses the driver with untrusted connection properties.
No, versions prior to 42.1.0 and between 42.1.4 and 42.3.0 are not affected. The vulnerability was fixed in version 42.1.4 and again in version 42.3.3.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and the tool will analyze it for any open-source vulnerabilities, including CVE-2022-26520.
You can refer to the vulnerability details on the Vulert website (https://vulert.com) or the Bitnami vulnerability database (https://github.com/bitnami/vulndb/tree/main/data/postgresql-jdbc-driver/BIT-postgresql-jdbc-driver-2022-26520.json) for more information.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-jdbc-driver.
