CVE-2022-41946: Vulnerability in org.postgresql:postgresql
Summary
CVE-2022-41946: TemporaryFolder on unix-like systems does not limit access to created files. Affects org.postgresql:postgresql across 4 version ranges.
>= 42.2.0, < 42.2.27
>= 42.3.0, < 42.3.8
>= 42.4.0, < 42.4.3
>= 42.5.0, < 42.5.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- postgresql-jdbc-driver · Bitnami
- libpgjava · Debian:11
The same CVE-2022-41946 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.postgresql:postgresql package is a popular open-source JDBC driver for PostgreSQL databases. It provides functionality for connecting to and interacting with PostgreSQL databases from Java applications. This package is widely used in various Java projects and is an essential component for accessing and managing PostgreSQL databases.
Vulnerability Detail
The vulnerability (CVE-2022-41946) in org.postgresql:postgresql arises from the use of PreparedStatement.setText(int, InputStream) and PreparedStatement.setBytea(int, InputStream) methods. When these methods are used with an InputStream larger than 51k, a temporary file is created. On Unix-like systems, this temporary file is readable by other users on the same system, except for macOS. This vulnerability allows unauthorized users to access the contents of these temporary files, resulting in an information disclosure risk. It is important to note that this vulnerability does not allow other users to modify or overwrite the files or directories.
How To Fix
Latest published version: 42.7.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 42.2.0, < 42.2.2742.2.27 -
>= 42.3.0, < 42.3.842.3.8 -
>= 42.4.0, < 42.4.342.4.3 -
>= 42.5.0, < 42.5.142.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not feasible, the following workaround can be implemented:
Set the java.io.tmpdir system environment variable to a directory owned exclusively by the executing user. This can be done by modifying the system configuration or by setting the environment variable programmatically before using the vulnerable methods. For example, in a Unix-like system:
export JAVA_OPTS="-Djava.io.tmpdir=/path/to/exclusive/directory"
Conclusion
The vulnerability in org.postgresql:postgresql (CVE-2022-41946) allows unauthorized users on Unix-like systems to access the contents of temporary files created by certain methods. To mitigate this vulnerability, it is recommended to update the package to the fixed versions or apply the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.postgresql:postgresql →
FAQ
The impact of this vulnerability is an information disclosure risk. Other users on Unix-like systems can read the contents of the temporary files created by the vulnerable methods. However, they cannot modify or overwrite the files or directories.
No, this vulnerability does not impact macOS. Temporary files created by the vulnerable methods are not readable by other users on macOS systems.
No, only versions between 42.2.0 and 42.2.27, 42.3.0 and 42.3.8, 42.4.0 and 42.4.3, and 42.5.0 and 42.5.1 are affected. Versions prior to 42.2.0 and versions after the fixed versions are not vulnerable.
Yes, the CVSS score for this vulnerability is 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).
You can find more information about this vulnerability in the Common Weakness Enumeration (CWE) database under the entry CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Additionally, you can refer to the fix commit on GitHub: https://github.com/pgjdbc/pgjdbc/commit/9008dc9aade6dbfe4efafcd6872ebc55f4699cf5
References
Related vulnerabilities
Recent vulnerabilities recorded for org.postgresql:postgresql.
