Read the docs
TI-2022-13237 Aliases CVE-2022-31197GHSA-r38f-c4h4-hqq2

SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc

Priority HIGH 70CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-89.

Summary

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet. Note that the application's JDBC user and the schema owner need not be the same. A JDBC application that executes as a privileged user querying database schemas owned by potentially malicious less-privileged users would be vulnerable. In that situation it may be possible for the malicious user to craft a schema that causes the application to execute commands as the privileged user. Patched versions will be released as `42.2.26` and `42.4.1`. Users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02355 83rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial pgjdbc (pgjdbc): 42.2.26, 42.4.1org.postgresql:postgresql (Maven): 42.2.26, 42.4.1, 42.3.7Red Hat: 4 advisoriesRed Hat: 4 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PostgreSQLpgjdbc42.2.0 to before 42.2.26; 42.3.0 to before 42.4.142.2.26, 42.4.1Patch availableCNA
—org.postgresql:postgresql (Maven)before 42.2.2642.2.26Patch availableGHSA-r38f-c4h4-hqq2
—org.postgresql:postgresql (Maven)42.4.0 to before 42.4.142.4.1Patch availableGHSA-r38f-c4h4-hqq2
—org.postgresql:postgresql (Maven)42.3.0 to before 42.3.742.3.7Patch availableGHSA-r38f-c4h4-hqq2
  • pgjdbc VendorPostgreSQL Affected 42.2.0 to before 42.2.26; 42.3.0 to before 42.4.1 Fixed in 42.2.26, 42.4.1 Patch available CNA
  • org.postgresql:postgresql (Maven) Vendor— Affected before 42.2.26 Fixed in 42.2.26 Patch available GHSA-r38f-c4h4-hqq2
  • org.postgresql:postgresql (Maven) Vendor— Affected 42.4.0 to before 42.4.1 Fixed in 42.4.1 Patch available GHSA-r38f-c4h4-hqq2
  • org.postgresql:postgresql (Maven) Vendor— Affected 42.3.0 to before 42.3.7 Fixed in 42.3.7 Patch available GHSA-r38f-c4h4-hqq2

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:*before 42.2.26; 42.3.0 to before 42.3.7VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql_jdbc_driver:42.4.0:-:*:*:*:*:*:*42.4.0VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql_jdbc_driver:42.4.0:rc1:*:*:*:*:*:*42.4.0 rc1VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql_jdbc_driver:42.4.1:rc1:*:*:*:*:*:*42.4.1 rc1VulnerablePostgreSQL
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
  • cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* Versions before 42.2.26; 42.3.0 to before 42.3.7 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql_jdbc_driver:42.4.0:-:*:*:*:*:*:* Versions 42.4.0 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql_jdbc_driver:42.4.0:rc1:*:*:*:*:*:* Versions 42.4.0 rc1 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql_jdbc_driver:42.4.1:rc1:*:*:*:*:*:* Versions 42.4.1 rc1 Vulnerable ·PostgreSQL
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA pgjdbc (pgjdbc) Fixed in 42.2.26, 42.4.1
  • Fix · GHSA-r38f-c4h4-hqq2 org.postgresql:postgresql (Maven) Fixed in 42.2.26 Advisory →
  • Fix · GHSA-r38f-c4h4-hqq2 org.postgresql:postgresql (Maven) Fixed in 42.4.1 Advisory →
  • Fix · GHSA-r38f-c4h4-hqq2 org.postgresql:postgresql (Maven) Fixed in 42.3.7 Advisory →

Red Hat 4 advisories

  • RHSA-2023:1006 Released 2023-03-08 · Red Hat rating Important
    Red Hat build of Quarkus 2.7.7 release and security update
    • Red Hat build of Quarkus 2.7.7
  • RHSA-2023:0318 Released 2023-01-23 · Red Hat rating Moderate
    postgresql-jdbc security update
    • Red Hat Enterprise Linux AppStream (v. 9) postgresql-jdbc-42.2.18-6.el9_1
  • RHSA-2022:9023 Released 2022-12-14 · Red Hat rating Important
    Red Hat build of Quarkus 2.13.5 release and security update
    • Red Hat build of Quarkus 2.13.5
Show 1 more Red Hat advisories
  • RHSA-2022:8652 Released 2022-11-28 · Red Hat rating Important
    Red Hat Fuse 7.11.1 release and security update
    • Red Hat Fuse 7.11.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:0318
Red Hat Fuse 7.11.1Fixed RHSA-2022:8652
Red Hat build of Quarkus 2.13.5Fixed RHSA-2022:9023
Red Hat build of Quarkus 2.7.7Fixed RHSA-2023:1006
Not affected: 5 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31197
  2. 2026-10-03 Alias added: GHSA-r38f-c4h4-hqq2

References

Exploit 1

Patch 1

Advisory 4

Other 6

  • TI-2024-01491 pgjdbc SQL Injection via line comment generation CVSS 3.1CRITICAL 10.0
  • TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
  • TI-2022-09860 In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call… CVSS 3.1CRITICAL 9.8
  • TI-2026-30519 pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS CVSS 3.1HIGH 7.5
  • TI-2025-31226 pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration CVSS 3.1HIGH 8.2
  • TI-2020-10739 PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. CVSS 3.1HIGH 7.7
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences