PT-2022-4318 · Postgresql+7 · Postgresql Jdbc Driver+7
Avecramer
+1
·
Published
2022-08-03
·
Updated
2025-03-18
·
CVE-2022-31197
CVSS v3.1
8.0
High
| Vector | AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PostgreSQL JDBC Driver versions prior to 42.2.26
PostgreSQL JDBC Driver versions prior to 42.4.1
Description
The PGJDBC implementation of the
java.sql.ResultRow.refreshRow() method is not performing escaping of column names, allowing a malicious column name that contains a statement terminator, e.g. ;, to lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the ResultSet.refreshRow() method are not impacted. User applications that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name whose column names would contain the malicious SQL and subsequently invoke the refreshRow() method on the ResultSet.Recommendations
For versions prior to 42.2.26, upgrade to version 42.2.26 or later.
For versions prior to 42.4.1, upgrade to version 42.4.1 or later.
As a temporary workaround, consider not using the
ResultSet.refreshRow() method.
If the ResultSet.refreshRow() method is used, ensure that the code that executes that method does not connect to a database that is controlled by an unauthenticated or malicious user.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Bitbucket
Postgresql Jdbc Driver
Red Hat
Rocky Linux
Suse