CVE-2022-31197

Published on: Not Yet Published

Last Modified on: 12/02/2022 08:04:00 PM UTC

CVE-2022-31197 - advisory for GHSA-r38f-c4h4-hqq2

Source: Mitre Source: NIST CVE.ORG Print: PDF PDF
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Certain versions of Debian Linux from Debian contain the following vulnerability:

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet. Note that the application's JDBC user and the schema owner need not be the same. A JDBC application that executes as a privileged user querying database schemas owned by potentially malicious less-privileged users would be vulnerable. In that situation it may be possible for the malicious user to craft a schema that causes the application to execute commands as the privileged user. Patched versions will be released as `42.2.26` and `42.4.1`. Users are advised to upgrade. There are no known workarounds for this issue.

  • CVE-2022-31197 has been assigned by URL Logo [email protected] to track the vulnerability - currently rated as HIGH severity.
  • Affected Vendor/Software: URL Logo pgjdbc - pgjdbc version >= 42.2.0, < 42.2.26
  • Affected Vendor/Software: URL Logo pgjdbc - pgjdbc version >= 42.3.0, < 42.4.1

CVSS3 Score: 8 - HIGH

Attack
Vector
Attack
Complexity
Privileges
Required
User
Interaction
NETWORK LOW LOW REQUIRED
Scope Confidentiality
Impact
Integrity
Impact
Availability
Impact
UNCHANGED HIGH HIGH HIGH

CVE References

Description Tags Link
[SECURITY] Fedora 36 Update: postgresql-jdbc-42.3.1-4.fc36 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
text/html
URL Logo FEDORA FEDORA-2022-d7d49b2fac
[SECURITY] Fedora 35 Update: postgresql-jdbc-42.2.26-1.fc35 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
text/html
URL Logo FEDORA FEDORA-2022-cdeabe1bc0
SQL Injection in ResultSet.refreshRow() with malicious column names · Advisory · pgjdbc/pgjdbc · GitHub github.com
text/html
URL Logo CONFIRM github.com/pgjdbc/pgjdbc/security/advisories/GHSA-r38f-c4h4-hqq2
[SECURITY] [DLA 3140-1] libpgjava security update lists.debian.org
text/html
URL Logo MLIST [debian-lts-announce] 20221008 [SECURITY] [DLA 3140-1] libpgjava security update
Merge pull request from GHSA-r38f-c4h4-hqq2 · pgjdbc/[email protected] · GitHub github.com
text/html
URL Logo MISC github.com/pgjdbc/pgjdbc/commit/739e599d52ad80f8dcd6efedc6157859b1a9d637

Related QID Numbers

  • 160431 Oracle Enterprise Linux Security Update for postgresql-jdbc (ELSA-2023-0318)
  • 181118 Debian Security Update for libpgjava (DLA 3140-1)
  • 241119 Red Hat Update for postgresql-jdbc (RHSA-2023:0318)
  • 283174 Fedora Security Update for postgresql (FEDORA-2022-d7d49b2fac)
  • 283175 Fedora Security Update for postgresql (FEDORA-2022-cdeabe1bc0)
  • 502490 Alpine Linux Security Update for java-postgresql-jdbc
  • 672416 EulerOS Security Update for postgresql-jdbc (EulerOS-SA-2022-2803)
  • 690940 Free Berkeley Software Distribution (FreeBSD) Security Update for puppetdb (aeb4c85b-3600-11ed-b52d-589cfc007716)
  • 752659 SUSE Enterprise Linux Security Update for postgresql-jdbc (SUSE-SU-2022:3541-1)
  • 753226 SUSE Enterprise Linux Security Update for postgresql-jdbc (SUSE-SU-2022:3537-1)
  • 753484 SUSE Enterprise Linux Security Update for postgresql-jdbc (SUSE-SU-2022:3613-1)
  • 940900 AlmaLinux Security Update for postgresql-jdbc (ALSA-2023:0318)

Exploit/POC from Github

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, da…

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
Operating
System
DebianDebian Linux10.0AllAllAll
Operating
System
FedoraprojectFedora35AllAllAll
Operating
System
FedoraprojectFedora36AllAllAll
ApplicationPostgresqlPostgresql Jdbc DriverAllAllAllAll
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*:
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*:
  • cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:*:

Social Mentions

Source Title Posted (UTC)
Twitter Icon @CVEreport CVE-2022-31197 : PostgreSQL JDBC Driver PgJDBC for short allows Java programs to connect to a PostgreSQL database… twitter.com/i/web/status/1… 2022-08-03 19:15:31
Twitter Icon @LinInfoSec Postgresql - CVE-2022-31197: github.com/pgjdbc/pgjdbc/… 2022-08-03 21:10:07
Twitter Icon @autumn_good_35 CVE-2022-31197 PostgreSQL JDBC versions 42.4.1/42.2.26 Security Update postgresql.org/about/news/pos… 2022-08-16 12:58:37
Twitter Icon @pyn3rd CVE-2022-31197 PostgreSQL JDBC driver SQL injection. https://t.co/SAfVGNWFyd 2022-08-25 05:29:35
Twitter Icon @ipssignatures I know no IPS that has a protection/signature/rule for the vulnerability CVE-2022-31197. The vuln was published 21… twitter.com/i/web/status/1… 2022-08-25 08:04:01
Twitter Icon @ipssignatures The vuln CVE-2022-31197 has a tweet created 0 days ago and retweeted 16 times. twitter.com/pyn3rd/status/… #Sm2pwbzg2xdk36 2022-08-25 08:04:01
Reddit Logo Icon /r/netcve CVE-2022-31197 2022-08-03 20:38:54
© CVE.report 2023 Twitter Nitter Twitter Viewer |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report