CVEvulnerability
CVE-2022-26520
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-03-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties
Affected configurations
• postgresql postgresql jdbc driver (>= 42.1.0 <= 42.1.4)
• postgresql postgresql jdbc driver (>= 42.3.0 < 42.3.3)
• debian debian linux 10.0
• debian debian linux 11.0
References
- https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc Patch, Third Party Advisory
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8 Third Party Advisory
- https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3 Release Notes, Vendor Advisory
- https://jdbc.postgresql.org/documentation/head/tomcat.html Vendor Advisory
- https://www.debian.org/security/2022/dsa-5196 Third Party Advisory
- https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc Patch, Third Party Advisory
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8 Third Party Advisory
- https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3 Release Notes, Vendor Advisory
- https://jdbc.postgresql.org/documentation/head/tomcat.html Vendor Advisory
- https://www.debian.org/security/2022/dsa-5196 Third Party Advisory