Information Disclosure Vulnerability in pgjdbc (CVE-2022-41946)
Summary
CVE-2022-41946: pgjdbc is an open source postgresql JDBC Driver. Affects libpgjava across 2 version ranges.
< 42.2.15-1+deb11u2
< 9008dc9aade6dbfe4efafcd6872ebc55f4699cf5
Fixed in 42.2.15-1+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgjdbc is an open-source PostgreSQL JDBC Driver that enables Java applications to interact with PostgreSQL databases. It provides a robust and efficient way to execute SQL queries and manage database connections. However, certain versions of pgjdbc are susceptible to an information disclosure vulnerability that arises when handling large InputStreams in prepared statements.
Vulnerability Detail
The vulnerability, identified as CVE-2022-41946, occurs when a prepared statement uses either PreparedStatement.setText(int, InputStream) or PreparedStatement.setBytea(int, InputStream) with InputStreams larger than 2k. This results in the creation of temporary files in the system's temporary directory, which are readable by other users on Unix-like systems. This poses a risk of sensitive information being exposed to unauthorized users, although it does not allow them to modify the files. The issue is particularly relevant for users on Java versions prior to 1.7, as no patch is available for these versions.
How To Fix
Minimum fixed version
42.2.15-1+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpgjavaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not feasible, users running Java 1.6 or lower can mitigate the vulnerability by specifying the java.io.tmpdir system environment variable to point to a directory that is exclusively owned by the executing user. This can be done by adding the following line to your Java application startup script:
-Djava.io.tmpdir=/path/to/secure/tmpdir
Conclusion
CVE-2022-41946 represents a significant information disclosure vulnerability in the pgjdbc PostgreSQL JDBC Driver, particularly affecting users on Unix-like systems. It is crucial for users to upgrade to the latest versions or implement workarounds to safeguard sensitive information from unauthorized access.
See every vulnerability recorded for libpgjava →
FAQ
CVE-2022-41946 is an information disclosure vulnerability in the pgjdbc PostgreSQL JDBC Driver that allows sensitive data to be exposed through temporary files.
All versions of pgjdbc prior to 4.5.0 are affected when using Java 1.7 and above. Java 1.6 and lower versions do not have a patch available.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you are unable to upgrade your Java version, set the java.io.tmpdir system environment variable to a secure directory that is exclusively owned by the executing user.
The CVSS score for CVE-2022-41946 is 5.5, indicating a moderate level of risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for libpgjava.
