PT-2023-19944 · Geotools · Geotools

Jodygarnett

+1

·

Published

2023-02-21

·

Updated

2023-03-02

·

CVE-2023-25158

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions GeoTools versions prior to 27.4 GeoTools versions prior to 28.2
Description GeoTools is an open source Java library that provides tools for geospatial data. It includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations. The issue affects various filter and function implementations, including PropertyIsLike, strEndsWith, strStartsWith, FeatureId, jsonArrayContains, and DWithin.
Recommendations To resolve the issue, upgrade to either version 27.4 or 28.2. As a temporary workaround, consider disabling encode functions for PostGIS DataStores. Alternatively, enable prepared statements for JDBCDataStores as a partial mitigation. For PostGIS DataStore, set preparedStatements to true and encode functions to false in the data store parameters to mitigate the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-25158
GHSA-99C3-QC2Q-P94M

Affected Products

Geotools