CVE-2022-31197: PostgreSQL JDBC Driver - SQL Injection Vulnerability
Summary
CVE-2022-31197: SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc. Affects postgresql-jdbc-driver across 3 version ranges.
< 42.2.26
>= 42.3.0, < 42.3.7
>= 42.4.0, <= 42.4.0
Fixed in 42.2.26 or 42.3.7, depending on the release line you run. How to fix ↓
Also tracked for
- org.postgresql:postgresql · Maven
- libpgjava · Debian:11
The same CVE-2022-31197 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PostgreSQL JDBC Driver (PgJDBC) is a library that enables Java programs to connect to a PostgreSQL database using standard, database-independent Java code. It provides a convenient way for Java applications to interact with PostgreSQL databases and execute SQL queries. The driver is widely used in various applications and frameworks that require connectivity to PostgreSQL databases.
Vulnerability Detail
The vulnerability (CVE-2022-31197) in the PostgreSQL JDBC Driver arises from a flaw in the implementation of the java.sql.ResultRow.refreshRow() method. This method does not properly escape column names, making it susceptible to SQL injection attacks. An attacker can exploit this vulnerability by crafting a malicious column name containing a statement terminator, such as a semicolon (;), which can lead to the execution of additional SQL commands. The impact of this vulnerability depends on the privileges of the JDBC user and the control the attacker has over the underlying database. If the application's JDBC user has sufficient privileges and the attacker can manipulate the column names, they may be able to execute arbitrary SQL commands with the privileges of the JDBC user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 42.2.2642.2.26 -
>= 42.3.0, < 42.3.742.3.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. Upgrading to the patched versions is the recommended solution.
Conclusion
The PostgreSQL JDBC Driver is vulnerable to a SQL injection attack due to a flaw in the java.sql.ResultRow.refreshRow() method. Upgrading to the patched versions (42.2.26 and 42.4.1) is crucial to mitigate this vulnerability. There are no known workarounds, and users are advised to update their dependencies or libraries that rely on the PostgreSQL JDBC Driver. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql-jdbc-driver →
FAQ
The PostgreSQL JDBC Driver (PgJDBC) is a library that allows Java programs to connect to PostgreSQL databases using standard Java code.
The impact of this vulnerability depends on the privileges of the JDBC user and the control the attacker has over the underlying database. If the application's JDBC user has sufficient privileges and the attacker can manipulate the column names, they may be able to execute arbitrary SQL commands with the privileges of the JDBC user.
To fix this vulnerability, you should upgrade to the patched versions of the PostgreSQL JDBC Driver (42.2.26 and 42.4.1). These versions include the necessary fixes to prevent SQL injection attacks.
There are no known workarounds for this vulnerability. Upgrading to the patched versions is the recommended solution.
You can find more information about this vulnerability in the PostgreSQL JDBC Driver documentation and the CVE-2022-31197 advisory.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-jdbc-driver.
