crítica
CVE-2022-26520
postgresql-jdbc: Arbitrary File Write Vulnerability
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami. Más baja según Red Hat (media), GHSA (baja).
Descripción
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | postgresql-jdbc-driver | 42.1.5, 42.3.3 |
| debian 10 | libpgjava | 42.2.5-2+deb10u1 |
| debian 11 | libpgjava | 42.2.15-1+deb11u1 |
| debian 12 | libpgjava | 42.3.3-1 |
| debian 13 | libpgjava | 42.3.3-1 |
| debian 14 | libpgjava | 42.3.3-1 |
| debian 9 | libpgjava | sin corrección indicada |
| echo | libpgjava | 42.3.3-1 |
| maven::GitHub Security Advisory Maven | org.postgresql:postgresql | 42.3.3 |
| Red Hat | postgresql-jdbc, postgresql-jdbc-javadoc | sin corrección indicada |
Mostrar las 11 entradas de 10 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | postgresql-jdbc-driver | 42.1.5, 42.3.3 |
| debian 10 | libpgjava | 42.2.5-2+deb10u1 |
| debian 11 | libpgjava | 42.2.15-1+deb11u1 |
| debian 12 | libpgjava | 42.3.3-1 |
| debian 13 | libpgjava | 42.3.3-1 |
| debian 14 | libpgjava | 42.3.3-1 |
| debian 9 | libpgjava | sin corrección indicada |
| echo | libpgjava | 42.3.3-1 |
| maven::GitHub Security Advisory Maven | org.postgresql:postgresql | 42.3.3 |
| Red Hat | postgresql-jdbc | sin corrección indicada |
| Red Hat | postgresql-jdbc-javadoc | sin corrección indicada |
Referencias
- https://access.redhat.com/security/cve/CVE-2022-26520
- https://github.com/pgjdbc/pgjdbc
- https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8
- https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3
- https://jdbc.postgresql.org/documentation/head/tomcat.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-26520
- https://www.cve.org/CVERecord?id=CVE-2022-26520