Information Disclosure Vulnerability in libpgjava Package: CVE-2022-41946
Summary
UBUNTU-CVE-2022-41946: pgjdbc is an open source postgresql JDBC Driver. Affects libpgjava versions 9.2-1002-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libpgjava package provides a JDBC driver for PostgreSQL, enabling Java applications to interact with PostgreSQL databases. It is widely used in enterprise applications for database connectivity. The package allows developers to execute SQL statements and manage database connections efficiently. However, certain versions of this package are vulnerable to an information disclosure issue that can expose sensitive data to unauthorized users on Unix-like systems.
Vulnerability Detail
The vulnerability arises from the handling of prepared statements using the methods PreparedStatement.setText(int, InputStream) and PreparedStatement.setBytea(int, InputStream). When the InputStream exceeds 2k in size, a temporary file is created in the system's temporary directory. This directory is shared among all users on Unix-like systems, making the temporary file readable by other users. This poses a risk of information disclosure, as sensitive data may be exposed. The vulnerability is classified with a CVSS score of 4.7, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not possible, set the java.io.tmpdir system property to a directory that is exclusively owned by the executing user. This can be done by adding the following line to your Java application startup command: -Djava.io.tmpdir=/path/to/secure/tmpdir. Ensure that the specified directory has the correct permissions to restrict access.
Conclusion
The CVE-2022-41946 vulnerability in the libpgjava package poses a significant risk of information disclosure on Unix-like systems. Users are encouraged to update to the patched version or implement the recommended workaround to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for libpgjava →
FAQ
CVE-2022-41946 is a vulnerability in the libpgjava package that allows for information disclosure through temporary files created by prepared statements.
Users of the libpgjava package on Unix-like systems running affected versions are at risk of this vulnerability.
The primary consequence is the unauthorized exposure of sensitive data stored in temporary files, which could be accessed by other users on the system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, a patch is available for users running Java 1.7 and higher in version 4.5.0 of the PostgreSQL JDBC Driver. Users on Java 1.6 or lower should consider upgrading their Java version.
Related vulnerabilities
Recent vulnerabilities recorded for libpgjava.
