kritik
CVE-2022-26520
postgresql-jdbc: Arbitrary File Write Vulnerability
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Bitnami. Daha düşük diyenler: Red Hat (orta), GHSA (düşük).
Açıklama
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | postgresql-jdbc-driver | 42.1.5, 42.3.3 |
| debian 10 | libpgjava | 42.2.5-2+deb10u1 |
| debian 11 | libpgjava | 42.2.15-1+deb11u1 |
| debian 12 | libpgjava | 42.3.3-1 |
| debian 13 | libpgjava | 42.3.3-1 |
| debian 14 | libpgjava | 42.3.3-1 |
| debian 9 | libpgjava | düzeltme belirtilmemiş |
| echo | libpgjava | 42.3.3-1 |
| maven::GitHub Security Advisory Maven | org.postgresql:postgresql | 42.3.3 |
| Red Hat | postgresql-jdbc, postgresql-jdbc-javadoc | düzeltme belirtilmemiş |
10 kaynaktaki 11 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | postgresql-jdbc-driver | 42.1.5, 42.3.3 |
| debian 10 | libpgjava | 42.2.5-2+deb10u1 |
| debian 11 | libpgjava | 42.2.15-1+deb11u1 |
| debian 12 | libpgjava | 42.3.3-1 |
| debian 13 | libpgjava | 42.3.3-1 |
| debian 14 | libpgjava | 42.3.3-1 |
| debian 9 | libpgjava | düzeltme belirtilmemiş |
| echo | libpgjava | 42.3.3-1 |
| maven::GitHub Security Advisory Maven | org.postgresql:postgresql | 42.3.3 |
| Red Hat | postgresql-jdbc | düzeltme belirtilmemiş |
| Red Hat | postgresql-jdbc-javadoc | düzeltme belirtilmemiş |
Referanslar
- https://access.redhat.com/security/cve/CVE-2022-26520
- https://github.com/pgjdbc/pgjdbc
- https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8
- https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3
- https://jdbc.postgresql.org/documentation/head/tomcat.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-26520
- https://www.cve.org/CVERecord?id=CVE-2022-26520