Log in Start free

Vulnerability · Published Aug 3, 2022 · Assigned by GitHub_M

CVE-2022-31197SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc

High 7.1

In plain English

A high-severity SQL injection in pgjdbc from pgjdbc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)2.4%top 16.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet. Note that the application's JDBC user and the schema owner need not be the same. A JDBC application that executes as a privileged user querying database schemas owned by potentially malicious less-privileged users would be vulnerable. In that situation it may be possible for the malicious user to craft a schema that causes the application to execute commands as the privileged user. Patched versions will be released as `42.2.26` and `42.4.1`. Users are advised to upgrade. There are no known workarounds for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9postgresql-jdbc42.2.18-6.el9_1ALSA-2023:0318
Alpine:v3.20java-postgresql-jdbc42.4.2-r0ALPINE-CVE-2022-31197
Alpine:v3.21java-postgresql-jdbc42.4.2-r0ALPINE-CVE-2022-31197
Alpine:v3.22java-postgresql-jdbc42.4.2-r0ALPINE-CVE-2022-31197
Alpine:v3.23java-postgresql-jdbc42.4.2-r0ALPINE-CVE-2022-31197
Alpine:v3.24java-postgresql-jdbc42.4.2-r0ALPINE-CVE-2022-31197
Debian:12libpgjava42.4.1-1DEBIAN-CVE-2022-31197
Debian:13libpgjava42.4.1-1DEBIAN-CVE-2022-31197
Debian:14libpgjava42.4.1-1DEBIAN-CVE-2022-31197
Mavenorg.postgresql:postgresql42.3.7GHSA-r38f-c4h4-hqq2
Mavenorg.postgresql:postgresql42.2.26GHSA-r38f-c4h4-hqq2
Mavenorg.postgresql:postgresql42.4.1GHSA-r38f-c4h4-hqq2
Rocky Linux:9postgresql-jdbc0:42.2.18-6.el9_1RLSA-2023:0318
Ubuntu:22.04:LTSlibpgjavano fix listedUBUNTU-CVE-2022-31197
Ubuntu:24.04:LTSlibpgjavano fix listedUBUNTU-CVE-2022-31197
Ubuntu:25.10libpgjavano fix listedUBUNTU-CVE-2022-31197
Ubuntu:26.04:LTSlibpgjavano fix listedUBUNTU-CVE-2022-31197
Ubuntu:26.10libpgjavano fix listedUBUNTU-CVE-2022-31197

Affected products (as reported)

VendorProductVersions
pgjdbc pgjdbc >= 42.2.0, < 42.2.26>= 42.3.0, < 42.4.1

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

References