CVE-2022-21724: Vulnerability in org.postgresql:postgresql
Summary
CVE-2022-21724: pgjdbc Does Not Check Class Instantiation when providing Plugin Classes. Affects org.postgresql:postgresql across 2 version ranges.
>= 9.4.1208, < 42.2.25
>= 42.3.0, < 42.3.2
Fixed in 42.2.25 or 42.3.2, depending on the release line you run. How to fix ↓
Also tracked for
- postgresql-jdbc-driver · Bitnami
- libpgjava · Debian:11
The same CVE-2022-21724 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.postgresql:postgresql is an open-source JDBC driver for PostgreSQL databases. It provides connectivity between Java applications and PostgreSQL databases, allowing developers to interact with the database using Java code. The driver supports various features and connection properties to customize the behavior of the connection. However, a vulnerability has been discovered in versions 9.4.1208 to 42.2.25 and versions 42.3.0 to 42.3.2 of the driver.
Vulnerability Detail
The vulnerability in org.postgresql:postgresql allows an attacker to instantiate plugin instances based on class names provided via connection properties without verifying if the class implements the expected interface. This can lead to the execution of arbitrary code or unauthorized access to sensitive information. An attacker can exploit this vulnerability by providing a malicious class name as a connection property, allowing them to execute arbitrary code or perform unauthorized actions within the context of the application using the vulnerable driver.
How To Fix
Latest published version: 42.7.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 9.4.1208, < 42.2.2542.2.25 -
>= 42.3.0, < 42.3.242.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a workaround can be implemented by validating the class names provided via connection properties before instantiating them. This can be done by checking if the class implements the expected interface or belongs to a trusted package. Here's an example of how to implement this workaround in Java:
String className = "org.springframework.context.support.ClassPathXmlApplicationContext";
if (isValidClassName(className)) {
// Instantiate the class
} else {
// Handle invalid class name
}
private boolean isValidClassName(String className) {
try {
Class<?> clazz = Class.forName(className);
// Check if the class implements the expected interface or belongs to a trusted package
// Return true if valid, false otherwise
} catch (ClassNotFoundException e) {
return false;
}
}
Conclusion
The vulnerability in org.postgresql:postgresql allows an attacker to execute arbitrary code or perform unauthorized actions within the context of the application. It is recommended to upgrade to a fixed version of the driver (42.2.25 or 42.3.2) to mitigate this vulnerability. If immediate upgrade is not possible, implement the provided workaround to validate class names before instantiation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.postgresql:postgresql →
FAQ
org.postgresql:postgresql is an open-source JDBC driver for PostgreSQL databases. It allows Java applications to connect to and interact with PostgreSQL databases.
This vulnerability allows an attacker to execute arbitrary code or perform unauthorized actions within the context of the application using the vulnerable driver. This can lead to the compromise of sensitive information or the execution of malicious activities.
To fix this vulnerability, you should upgrade to a fixed version of org.postgresql:postgresql. The vulnerability has been fixed in versions 42.2.25 and 42.3.2. Update your project's dependencies to use the latest fixed version and rebuild/redeploy your application.
Yes, if upgrading to a fixed version is not immediately possible, you can implement a workaround by validating the class names provided via connection properties before instantiating them. Check if the class implements the expected interface or belongs to a trusted package.
You can find more information about this vulnerability in the advisory published on the GitHub Advisory Database. The link to the advisory is provided in the 'database_specific' field of the affected package.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.postgresql:postgresql.
