CVE-2023-25158: Unfiltered SQL Injection in Geotools
GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations. Users are advised to upgrade to either version 27.4 or to 28.2 to resolve this issue. Users unable to upgrade may disable encode functions for PostGIS DataStores or enable prepared statements for JDBCDataStores as a partial mitigation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-25158?
CVE-2023-25158 is classified as a medium severity SQL Injection vulnerability.
How do I fix CVE-2023-25158?
To fix CVE-2023-25158, upgrade GeoTools to a version equal to or greater than 24.7 or to a version that does not exhibit the vulnerability.
Which versions of GeoTools are affected by CVE-2023-25158?
CVE-2023-25158 affects GeoTools versions prior to 24.7 and versions from 25.0 up to 25.7, 26.0 up to 26.7, 27.0 up to 27.4, and 28.0 up to 28.2.
What impact does CVE-2023-25158 have on applications?
CVE-2023-25158 could allow an attacker to execute arbitrary SQL commands, leading to potential data leaks or unauthorized data manipulation.
Is CVE-2023-25158 being actively exploited?
As of now, there is no public information indicating that CVE-2023-25158 is actively being exploited in the wild.