Arbitrary File Write Vulnerability in libpgjava: CVE-2022-26520
Summary
UBUNTU-CVE-2022-26520: DISPUTED In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. Affects libpgjava versions < 42.3.3-1. Fixed in 42.3.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpgjava is a JDBC driver for PostgreSQL, allowing Java applications to interact with PostgreSQL databases. It is widely used in various applications for database connectivity. The package is part of the Ubuntu 22.04 LTS ecosystem and is essential for developers who rely on PostgreSQL for data management. However, it has been identified to have a vulnerability that could allow attackers to exploit the JDBC driver under certain conditions.
Vulnerability Detail
The vulnerability identified as CVE-2022-26520 exists in pgjdbc versions prior to 42.3.3. An attacker who controls the JDBC URL or connection properties can exploit this vulnerability to invoke java.util.logging.FileHandler, allowing them to write to arbitrary files on the server. This could lead to severe consequences, such as creating executable JSP files in a Tomcat web root, which could be executed by the server, leading to unauthorized access or control over the application. The vendor disputes the claim, stating that the vulnerability lies in the application's use of untrusted connection properties rather than in the pgjdbc driver itself.
How To Fix
Minimum fixed version
42.3.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpgjavaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using untrusted connection properties in your JDBC URLs. Ensure that any connection properties are validated and sanitized before being used in your application. This will help mitigate the risk of exploitation until the package can be updated.
Conclusion
CVE-2022-26520 represents a significant security risk for applications using the libpgjava JDBC driver prior to version 42.3.3. It is crucial for developers to update to the patched version to protect their applications from potential exploitation. Additionally, implementing best practices for validating connection properties can help mitigate risks until updates can be applied.
See every vulnerability recorded for libpgjava →
FAQ
CVE-2022-26520 is a vulnerability in the pgjdbc driver that allows attackers to write to arbitrary files through manipulated JDBC connection properties.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2022-26520 is 9.8, indicating a critical level of severity.
Yes, the patched version of the libpgjava package is 42.3.3-1, which addresses this vulnerability.
If you cannot update the package right away, ensure that you validate and sanitize any JDBC connection properties to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for libpgjava.
