Critical Code Execution Vulnerability in PostgreSQL JDBC Driver (libpgjava)
Summary
CVE-2022-21724: pgjdbc is the offical PostgreSQL JDBC Driver. Affects libpgjava across 3 version ranges.
< 42.2.15-1+deb11u1
< c7555123aaef705d6e35693da4c0daa3db2e9cd7
< f4d0ed69c0b3aae8531d83d6af4c57f22312c813
Fixed in 42.2.15-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PostgreSQL JDBC Driver, known as pgjdbc, is the official driver for connecting Java applications to PostgreSQL databases. It allows developers to execute SQL queries and manage database connections seamlessly. However, a significant security vulnerability has been identified in the driver, which can lead to severe consequences if exploited. The vulnerability arises from the driver's failure to validate class names provided in connection properties, potentially allowing attackers to execute arbitrary code.
Vulnerability Detail
A security hole was discovered in the PostgreSQL JDBC Driver (pgjdbc) during security research. The vulnerability stems from the driver's ability to instantiate plugin instances based on class names provided via connection properties such as 'authenticationPluginClassName' and 'sslFactory'. The driver does not verify whether the specified class implements the expected interface before instantiation. This oversight can lead to code execution via arbitrary classes, posing a significant risk to systems using the driver. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
42.2.15-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpgjavaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this issue. The best course of action is to upgrade to the fixed versions of the PostgreSQL JDBC Driver as mentioned above.
Conclusion
The PostgreSQL JDBC Driver vulnerability (CVE-2022-21724) poses a critical risk due to its potential for arbitrary code execution. Users are strongly advised to upgrade to the latest versions of the driver to mitigate this risk. Regular monitoring and updates are essential to maintain the security of applications using this driver.
See every vulnerability recorded for libpgjava →
FAQ
The PostgreSQL JDBC Driver (pgjdbc) is a Java-based driver that enables Java applications to connect to and interact with PostgreSQL databases.
This vulnerability allows an attacker to execute arbitrary code on the system by controlling the class names provided in the JDBC connection properties.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By using a manifest file like package-lock.json, Vulert can identify if your application is affected by this vulnerability.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
You can upgrade the driver using package management commands. For Debian 11, use 'apt-get install libpgjava=42.2.15-1+deb11u1'. For Debian 12 and 13, use 'apt-get install libpgjava=42.3.2-1'.
Related vulnerabilities
Recent vulnerabilities recorded for libpgjava.
