CVE-2022-26520: Critical severity PostgreSQL PostgreSQL JDBC driver vulnerability
DISPUTED In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties.
Other sources
A flaw was found in Postgres JDBC. This flaw allows an attacker to use a method to write arbitrary files through the connection properties settings. For example, an attacker can create an executable file under the server the application is running and make it a new part of the application or server.
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties.
https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8 https://jdbc.postgresql.org/documentation/changelog.html#version42.3.3 https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc https://jdbc.postgresql.org/documentation/head/tomcat.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.postgresql:postgresqlto a version that resolves this vulnerability.Fixed in 42.3.3 - Upgrade
Upgrade
debian/libpgjavato a version that resolves this vulnerability.Fixed in 42.2.5-2+deb10u1Fixed in 42.2.5-2+deb10u3Fixed in 42.2.15-1+deb11u1Fixed in 42.5.4-1Fixed in 42.6.0-2 - Upgrade
Upgrade
pgjdbcto a version that resolves this vulnerability.Fixed in 42.3.3Patch GHSA-673j-qm5f-xpv8 - Configuration
Ensure the JDBC URL and connection properties that set loggerFile and loggerLevel are not attacker-controlled (only use trusted, application-controlled values), because in pgjdbc versions before 42.3.3 attacker-controlled loggerFile/loggerLevel can be used to write arbitrary files via java.util.logging.FileHandler.
pgjdbc loggerFile / loggerLevel connection properties (used to configure java.util.logging.FileHandler) = Do not supply untrusted values; ensure attacker cannot control jdbc URL or these properties - Compensating control
If the application accepts user-controlled JDBC URL/properties (directly or indirectly), prevent that by validating/whitelisting connection property inputs so an attacker cannot set java.util.logging.FileHandler parameters such as loggerFile/loggerLevel.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-26520?
CVE-2022-26520 is a vulnerability found in Postgres JDBC that allows an attacker to write to arbitrary files.
How does the CVE-2022-26520 vulnerability work?
The vulnerability allows an attacker who controls the jdbc URL or properties to call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties.
What is the severity of CVE-2022-26520?
The severity of CVE-2022-26520 is critical with a CVSS score of 9.8.
Which software versions are affected by CVE-2022-26520?
Versions of Postgres JDBC prior to 42.3.3 and certain versions of libpgjava and PostgreSQL JDBC Driver are affected by CVE-2022-26520.
How can I fix the CVE-2022-26520 vulnerability?
To fix the CVE-2022-26520 vulnerability, you should update your Postgres JDBC library to version 42.3.3 or later.