Unchecked Class Instantiation when providing Plugin Classes
Priority HIGH 76CWE-665Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 4 fixed, 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03094 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.postgresql:postgresql (Maven): 42.2.25, 42.3.2Red Hat: 4 advisoriesRed Hat: 4 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.postgresql:postgresql (Maven) | 9.4.1208 to before 42.2.25 | 42.2.25 | Patch available | GHSA-v7wg-cpwc-24m4 |
| — | org.postgresql:postgresql (Maven) | 42.3.0 to before 42.3.2 | 42.3.2 | Patch available | GHSA-v7wg-cpwc-24m4 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.postgresql:postgresql (Maven) Vendor— Affected 9.4.1208 to before 42.2.25 Fixed in 42.2.25 Patch available GHSA-v7wg-cpwc-24m4
- org.postgresql:postgresql (Maven) Vendor— Affected 42.3.0 to before 42.3.2 Fixed in 42.3.2 Patch available GHSA-v7wg-cpwc-24m4
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* | before 42.2.25; 42.3.0 to before 42.3.2 | Vulnerable | PostgreSQL |
| cpe:2.3:a:postgresql:postgresql_jdbc_driver:42.3.2:rc1:*:*:*:*:*:* | 42.3.2 rc1 | Vulnerable | PostgreSQL |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* | before 2.7.2 | Vulnerable | quarkusio |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* Versions before 42.2.25; 42.3.0 to before 42.3.2 Vulnerable ·PostgreSQL
- cpe:2.3:a:postgresql:postgresql_jdbc_driver:42.3.2:rc1:*:*:*:*:*:* Versions 42.3.2 rc1 Vulnerable ·PostgreSQL
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 2.7.2 Vulnerable ·quarkusio
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-v7wg-cpwc-24m4 org.postgresql:postgresql (Maven) Fixed in 42.2.25 Advisory →
- Fix · GHSA-v7wg-cpwc-24m4 org.postgresql:postgresql (Maven) Fixed in 42.3.2 Advisory →
Red Hat 4 advisories
- RHSA-2022:6835 Released 2022-10-06 · Red Hat rating ImportantService Registry (container images) release and security update [2.3.0.GA]
- RHINT Service Registry 2.3.0 GA
- RHSA-2022:6813 Released 2022-10-05 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.1 security update
- RHPAM 7.13.1 async
- RHSA-2022:5532 Released 2022-07-07 · Red Hat rating ImportantRed Hat Fuse 7.11.0 release and security update
- Red Hat Fuse 7.11
Show 1 more Red Hat advisories
- RHSA-2022:4623 Released 2022-05-18 · Red Hat rating ModerateRed Hat build of Quarkus 2.7.5 release and security update
- Red Hat build of Quarkus 2.7.5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix planned: Will not fix |
| Red Hat Integration Service Registry | Affected | No fix yet |
| RHINT Service Registry 2.3.0 GA | Fixed | RHSA-2022:6835 |
| RHPAM 7.13.1 async | Fixed | RHSA-2022:6813 |
| Red Hat Fuse 7.11 | Fixed | RHSA-2022:5532 |
| Red Hat build of Quarkus 2.7.5 | Fixed | RHSA-2022:4623 |
Not affected: 2 products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2022-21724
- 2026-10-03 Alias added: GHSA-v7wg-cpwc-24m4
References
Advisory 5
Sources
- CVE-2022-21724 · CVE Program
- CVE-2022-21724 · NVD
- FIRST EPSS
- GHSA-v7wg-cpwc-24m4 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-21724 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences