SQL Injection Vulnerability in PostgreSQL JDBC Driver (libpgjava) - CVE-2022-31197
Summary
CVE-2022-31197: PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Affects libpgjava across 2 version ranges.
< 42.2.15-1+deb11u2
< 739e599d52ad80f8dcd6efedc6157859b1a9d637
Fixed in 42.2.15-1+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PostgreSQL JDBC Driver, commonly referred to as PgJDBC, is a crucial library that enables Java applications to connect to PostgreSQL databases using standard Java code. It provides a database-independent interface for executing SQL commands and retrieving results. The driver is widely used in enterprise applications for its reliability and performance. However, it has been identified to have a significant vulnerability that affects its security when handling certain database operations.
Vulnerability Detail
CVE-2022-31197 is a vulnerability in the PgJDBC implementation of the java.sql.ResultRow.refreshRow() method. This method fails to properly escape column names, allowing an attacker to inject malicious SQL code through specially crafted column names. If a user application invokes the refreshRow() method on a ResultSet, and the underlying database is controlled by an attacker, this could lead to SQL injection. The attacker can execute arbitrary SQL commands as the application's JDBC user, potentially compromising sensitive data and system integrity. This vulnerability is particularly concerning for applications running with elevated privileges, as it could allow less-privileged users to execute commands as a privileged user.
How To Fix
Minimum fixed version
42.2.15-1+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpgjavaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this issue. The best course of action is to upgrade to the patched versions of the PostgreSQL JDBC Driver as soon as possible.
Conclusion
CVE-2022-31197 presents a serious SQL injection vulnerability in the PostgreSQL JDBC Driver, which can lead to unauthorized SQL command execution. Users are strongly advised to upgrade to the patched versions to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for libpgjava →
FAQ
CVE-2022-31197 is a vulnerability in the PostgreSQL JDBC Driver that allows for SQL injection through improperly escaped column names in the refreshRow() method.
If your application uses the PostgreSQL JDBC Driver and invokes the refreshRow() method, it may be vulnerable if the underlying database is controlled by an attacker.
Exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands as the application's JDBC user, potentially leading to data breaches or system compromise.
You can upgrade the driver by modifying your build configuration file to include the latest version (42.2.26 or 42.4.1) of the PgJDBC driver.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for libpgjava.
