critical
9.8
CWE
665
Advisory Published
CVE Published
Updated

CVE-2022-21724: Unchecked Class Instantiation when providing Plugin Classes

First published: Tue Feb 01 2022(Updated: )

PostgreSQL JDBC Driver (PgJDBC) could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By sending a specially-crafted request using the "authenticationPluginClassName", "sslhostnameverifier", "socketFactory", "sslfactory", "sslpasswordcallback" classes, an attacker could exploit this vulnerability to execute arbitrary code on the system.

Credit: security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
IBM Disconnected Log Collector<=v1.0 - v1.8.2
Postgresql Postgresql Jdbc Driver<42.2.25
Postgresql Postgresql Jdbc Driver>=42.3.0<42.3.2
Postgresql Postgresql Jdbc Driver=42.3.2-rc1
Fedoraproject Fedora=35
Quarkus Quarkus<2.7.2
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Debian Debian Linux=11.0
debian/libpgjava
42.2.5-2+deb10u1
42.2.5-2+deb10u3
42.2.15-1+deb11u1
42.5.4-1
42.6.0-2

Remedy

https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is CVE-2022-21724?

    CVE-2022-21724 is a vulnerability in the PostgreSQL JDBC Driver (PgJDBC) that could allow a remote authenticated attacker to execute arbitrary code.

  • How does the vulnerability in CVE-2022-21724 occur?

    The vulnerability in CVE-2022-21724 occurs when the jdbc url or properties are controlled by the attacker, which can lead to the execution of arbitrary code.

  • What is the severity of CVE-2022-21724?

    The severity of CVE-2022-21724 is high, with a CVSS base score of 8.5.

  • Which software versions are affected by CVE-2022-21724?

    The PostgreSQL JDBC Driver versions up to and exclusive of 42.2.25 and 42.3.2 are affected by CVE-2022-21724.

  • How can I fix the vulnerability in CVE-2022-21724?

    To fix the vulnerability in CVE-2022-21724, you should update the PostgreSQL JDBC Driver to version 42.2.25 or higher.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203