In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.postgresql:postgresql (Maven) | 42.1.0 to before 42.3.3 | 42.3.3 | Patch available | GHSA-727h-hrw8-jg8q |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.postgresql:postgresql (Maven) Vendor— Affected 42.1.0 to before 42.3.3 Fixed in 42.3.3 Patch available GHSA-727h-hrw8-jg8q
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* | 42.1.0 – 42.1.4; 42.3.0 to before 42.3.3 | Vulnerable | PostgreSQL |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* Versions 42.1.0 – 42.1.4; 42.3.0 to before 42.3.3 Vulnerable ·PostgreSQL
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-727h-hrw8-jg8q org.postgresql:postgresql (Maven) Fixed in 42.3.3 Advisory →
Red Hat 3 advisories
- RHSA-2022:6835 Released 2022-10-06 · Red Hat rating ImportantService Registry (container images) release and security update [2.3.0.GA]
- RHINT Service Registry 2.3.0 GA
- RHSA-2022:6813 Released 2022-10-05 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.1 security update
- RHPAM 7.13.1 async
- RHSA-2022:5532 Released 2022-07-07 · Red Hat rating ImportantRed Hat Fuse 7.11.0 release and security update
- Red Hat Fuse 7.11
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat Integration Data Virtualisation Operator | Affected | No fix planned: Out of support scope |
| Red Hat build of Debezium 1 | Affected | No fix yet |
| RHINT Service Registry 2.3.0 GA | Fixed | RHSA-2022:6835 |
| RHPAM 7.13.1 async | Fixed | RHSA-2022:6813 |
| Red Hat Fuse 7.11 | Fixed | RHSA-2022:5532 |
Not affected: 4 products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Integration Camel Quarkus 1
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2022-26520
- 2026-10-03 Alias added: GHSA-727h-hrw8-jg8q
References
Advisory 5
Sources
- CVE-2022-26520 · CVE Program
- CVE-2022-26520 · NVD
- FIRST EPSS
- GHSA-727h-hrw8-jg8q · GitHub Advisory Database · CC BY 4.0
- CVE-2022-26520 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences