critical
CVE-2022-26520
postgresql-jdbc: Arbitrary File Write Vulnerability
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami. Rated lower by Red Hat (medium), GHSA (low).
Description
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | postgresql-jdbc-driver | 42.1.5, 42.3.3 |
| debian 10 | libpgjava | 42.2.5-2+deb10u1 |
| debian 11 | libpgjava | 42.2.15-1+deb11u1 |
| debian 12 | libpgjava | 42.3.3-1 |
| debian 13 | libpgjava | 42.3.3-1 |
| debian 14 | libpgjava | 42.3.3-1 |
| debian 9 | libpgjava | no fix listed |
| echo | libpgjava | 42.3.3-1 |
| maven::GitHub Security Advisory Maven | org.postgresql:postgresql | 42.3.3 |
| Red Hat | postgresql-jdbc, postgresql-jdbc-javadoc | no fix listed |
Show all 11 entries from 10 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | postgresql-jdbc-driver | 42.1.5, 42.3.3 |
| debian 10 | libpgjava | 42.2.5-2+deb10u1 |
| debian 11 | libpgjava | 42.2.15-1+deb11u1 |
| debian 12 | libpgjava | 42.3.3-1 |
| debian 13 | libpgjava | 42.3.3-1 |
| debian 14 | libpgjava | 42.3.3-1 |
| debian 9 | libpgjava | no fix listed |
| echo | libpgjava | 42.3.3-1 |
| maven::GitHub Security Advisory Maven | org.postgresql:postgresql | 42.3.3 |
| Red Hat | postgresql-jdbc | no fix listed |
| Red Hat | postgresql-jdbc-javadoc | no fix listed |
References
- https://access.redhat.com/security/cve/CVE-2022-26520
- https://github.com/pgjdbc/pgjdbc
- https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8
- https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3
- https://jdbc.postgresql.org/documentation/head/tomcat.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-26520
- https://www.cve.org/CVERecord?id=CVE-2022-26520