Vulnerability · Published Mar 7, 2022 · Assigned by mitre
CVE-2022-26520
Critical 9.8
In plain English
A critical-severity security flaw in the libpgjava package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libpgjava | 42.3.3-1 | DEBIAN-CVE-2022-26520 |
| Debian:13 | libpgjava | 42.3.3-1 | DEBIAN-CVE-2022-26520 |
| Debian:14 | libpgjava | 42.3.3-1 | DEBIAN-CVE-2022-26520 |
| Maven | org.postgresql:postgresql | 42.3.3 | GHSA-673j-qm5f-xpv8 |
| Maven | org.postgresql:postgresql | 42.3.3 | GHSA-727h-hrw8-jg8q |
| Ubuntu:22.04:LTS | libpgjava | 42.3.3-1 | UBUNTU-CVE-2022-26520 |
Affected products (as reported)
References
- https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3 x_refsource_MISC
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8 x_refsource_MISC
- https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc x_refsource_MISC
- https://jdbc.postgresql.org/documentation/head/tomcat.html x_refsource_MISC
- DSA-5196 vendor-advisory, x_refsource_DEBIAN