kritisch
CVE-2022-26520
postgresql-jdbc: Arbitrary File Write Vulnerability
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Bitnami. Niedriger laut Red Hat (mittel), GHSA (niedrig).
Beschreibung
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | postgresql-jdbc-driver | 42.1.5, 42.3.3 |
| debian 10 | libpgjava | 42.2.5-2+deb10u1 |
| debian 11 | libpgjava | 42.2.15-1+deb11u1 |
| debian 12 | libpgjava | 42.3.3-1 |
| debian 13 | libpgjava | 42.3.3-1 |
| debian 14 | libpgjava | 42.3.3-1 |
| debian 9 | libpgjava | kein Fix angegeben |
| echo | libpgjava | 42.3.3-1 |
| maven::GitHub Security Advisory Maven | org.postgresql:postgresql | 42.3.3 |
| Red Hat | postgresql-jdbc, postgresql-jdbc-javadoc | kein Fix angegeben |
Alle 11 Einträge aus 10 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | postgresql-jdbc-driver | 42.1.5, 42.3.3 |
| debian 10 | libpgjava | 42.2.5-2+deb10u1 |
| debian 11 | libpgjava | 42.2.15-1+deb11u1 |
| debian 12 | libpgjava | 42.3.3-1 |
| debian 13 | libpgjava | 42.3.3-1 |
| debian 14 | libpgjava | 42.3.3-1 |
| debian 9 | libpgjava | kein Fix angegeben |
| echo | libpgjava | 42.3.3-1 |
| maven::GitHub Security Advisory Maven | org.postgresql:postgresql | 42.3.3 |
| Red Hat | postgresql-jdbc | kein Fix angegeben |
| Red Hat | postgresql-jdbc-javadoc | kein Fix angegeben |
Referenzen
- https://access.redhat.com/security/cve/CVE-2022-26520
- https://github.com/pgjdbc/pgjdbc
- https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8
- https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3
- https://jdbc.postgresql.org/documentation/head/tomcat.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-26520
- https://www.cve.org/CVERecord?id=CVE-2022-26520