Read the docs
TI-2022-20287 Aliases CVE-2022-41946GHSA-562r-vg33-8x8h

TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc

Priority LOW 26CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 11 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `PreparedStatemet.setBytea(int, InputStream)` will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which is readable by other users on Unix like systems, but not MacOS. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. Java 1.7 and higher users: this vulnerability is fixed in 4.5.0. Java 1.6 and lower users: no patch is available. If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will mitigate this vulnerability.

Why it matters now

EPSS 0.00552 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial pgjdbc (pgjdbc): 42.2.27, 42.4.3, 42.5.1org.postgresql:postgresql (Maven): 42.2.27, 42.3.8, 42.4.3 +1Red Hat: 12 advisoriesRed Hat: 11 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PostgreSQLpgjdbc42.2.0 to before 42.2.27; > 42.3.0, < 42.3.8; 42.4.0 to before 42.4.3; 42.5.0 to before 42.5.142.2.27, 42.4.3, 42.5.1Patch availableCNA
—org.postgresql:postgresql (Maven)42.2.0 to before 42.2.2742.2.27Patch availableGHSA-562r-vg33-8x8h
—org.postgresql:postgresql (Maven)42.3.0 to before 42.3.842.3.8Patch availableGHSA-562r-vg33-8x8h
—org.postgresql:postgresql (Maven)42.4.0 to before 42.4.342.4.3Patch availableGHSA-562r-vg33-8x8h
—org.postgresql:postgresql (Maven)42.5.0 to before 42.5.142.5.1Patch availableGHSA-562r-vg33-8x8h
  • pgjdbc VendorPostgreSQL Affected 42.2.0 to before 42.2.27; > 42.3.0, < 42.3.8; 42.4.0 to before 42.4.3; 42.5.0 to before 42.5.1 Fixed in 42.2.27, 42.4.3, 42.5.1 Patch available CNA
  • org.postgresql:postgresql (Maven) Vendor— Affected 42.2.0 to before 42.2.27 Fixed in 42.2.27 Patch available GHSA-562r-vg33-8x8h
  • org.postgresql:postgresql (Maven) Vendor— Affected 42.3.0 to before 42.3.8 Fixed in 42.3.8 Patch available GHSA-562r-vg33-8x8h
  • org.postgresql:postgresql (Maven) Vendor— Affected 42.4.0 to before 42.4.3 Fixed in 42.4.3 Patch available GHSA-562r-vg33-8x8h
  • org.postgresql:postgresql (Maven) Vendor— Affected 42.5.0 to before 42.5.1 Fixed in 42.5.1 Patch available GHSA-562r-vg33-8x8h

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:*42.2.0 to before 42.2.27; 42.3.0 to before 42.3.8; 42.4.0 to before 42.4.3VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql_jdbc_driver:42.5.0:-:*:*:*:*:*:*42.5.0VulnerablePostgreSQL
cpe:2.3:a:postgresql:postgresql_jdbc_driver:42.5.0:rc1:*:*:*:*:*:*42.5.0 rc1VulnerablePostgreSQL
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* Versions 42.2.0 to before 42.2.27; 42.3.0 to before 42.3.8; 42.4.0 to before 42.4.3 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql_jdbc_driver:42.5.0:-:*:*:*:*:*:* Versions 42.5.0 Vulnerable ·PostgreSQL
  • cpe:2.3:a:postgresql:postgresql_jdbc_driver:42.5.0:rc1:*:*:*:*:*:* Versions 42.5.0 rc1 Vulnerable ·PostgreSQL
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA pgjdbc (pgjdbc) Fixed in 42.2.27, 42.4.3, 42.5.1
  • Fix · GHSA-562r-vg33-8x8h org.postgresql:postgresql (Maven) Fixed in 42.2.27 Advisory →
  • Fix · GHSA-562r-vg33-8x8h org.postgresql:postgresql (Maven) Fixed in 42.3.8 Advisory →
  • Fix · GHSA-562r-vg33-8x8h org.postgresql:postgresql (Maven) Fixed in 42.4.3 Advisory →
  • Fix · GHSA-562r-vg33-8x8h org.postgresql:postgresql (Maven) Fixed in 42.5.1 Advisory →

Red Hat 12 advisories

  • RHSA-2023:3954 Released 2023-06-29 · Red Hat rating Critical
    Red Hat Fuse 7.12 release and security update
    • Red Hat Fuse 7.12
  • RHSA-2023:3906 Released 2023-06-28 · Red Hat rating Important
    Red Hat Integration Camel K 1.10.1 release security update
    • RHINT Camel-K-1.10.1
  • RHSA-2023:2867 Released 2023-05-16 · Red Hat rating Moderate
    postgresql-jdbc security update
    • Red Hat Enterprise Linux AppStream (v. 8) postgresql-jdbc-42.2.14-2.el8, postgresql-jdbc-javadoc-42.2.14-2.el8
Show 9 more Red Hat advisories
  • RHSA-2023:2378 Released 2023-05-09 · Red Hat rating Moderate
    postgresql-jdbc security update
    • Red Hat Enterprise Linux AppStream (v. 9) postgresql-jdbc-42.2.27-1.el9
  • RHSA-2023:2097 Released 2023-05-03 · Red Hat rating Important
    Satellite 6.13 Release
    • Red Hat Satellite 6.13 for RHEL 8 ansible-collection-redhat-satellite-3.9.0-2.el8sat, ansible-collection-redhat-satellite_operations-1.3.0-2.el8sat, ansible-lint-5.0.8-4.el8pc +47
  • RHSA-2023:1815 Released 2023-04-17 · Red Hat rating Low
    Red Hat Integration Debezium 2.1.4 security update
    • RHINT Debezium 2.1.4
  • RHSA-2023:1630 Released 2023-04-04 · Red Hat rating Important
    Satellite 6.12.3 Async Security Update
    • Red Hat Satellite 6.12 for RHEL 8 candlepin-4.1.20-1.el8sat, candlepin-selinux-4.1.20-1.el8sat
  • RHSA-2023:1177 Released 2023-03-09 · Red Hat rating Important
    Red Hat Integration Camel Extension For Quarkus 2.7-1 security update
    • RHINT Camel-Q 2.7-1
  • RHSA-2023:1006 Released 2023-03-08 · Red Hat rating Important
    Red Hat build of Quarkus 2.7.7 release and security update
    • Red Hat build of Quarkus 2.7.7
  • RHSA-2023:0888 Released 2023-02-21 · Red Hat rating Moderate
    Red Hat Integration Camel Extension For Quarkus 2.13.2-1 security update
    • CEQ 2.13.2-1
  • RHSA-2023:0759 Released 2023-02-14 · Red Hat rating Moderate
    Red Hat Virtualization security and bug fix update
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-ansible-collection-2.4.2-1.el8ev, ovirt-engine-4.5.3.7-1.el8ev, ovirt-engine-backend-4.5.3.7-1.el8ev +20
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts ovirt-ansible-collection-2.4.2-1.el8ev
    • Red Hat Virtualization 4 Tools for Red Hat Enterprise Linux 8 ovirt-ansible-collection-2.4.2-1.el8ev
  • RHSA-2023:0758 Released 2023-02-14 · Red Hat rating Moderate
    Red Hat build of Quarkus 2.13.7 release and security update
    • Red Hat build of Quarkus

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Virtualization 4AffectedNo fix yet: Fix deferred
CEQ 2.13.2-1Fixed RHSA-2023:0888
RHINT Camel-K-1.10.1Fixed RHSA-2023:3906
RHINT Camel-Q 2.7-1Fixed RHSA-2023:1177
RHINT Debezium 2.1.4Fixed RHSA-2023:1815
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:2867
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:2378
Red Hat Fuse 7.12Fixed RHSA-2023:3954
Red Hat Satellite 6.12 for RHEL 8Fixed RHSA-2023:1630
Red Hat Satellite 6.13 for RHEL 8Fixed RHSA-2023:2097
Red Hat build of QuarkusFixed RHSA-2023:0758
Red Hat build of Quarkus 2.7.7Fixed RHSA-2023:1006
Not affected: 3 products
  • Red Hat Satellite 6.12 for RHEL 8
  • Red Hat Satellite 6.13 for RHEL 8
  • Red Hat build of Apicurio Registry 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41946
  2. 2026-10-03 Alias added: GHSA-562r-vg33-8x8h
  3. 2026-11-05 Affected versions changed · Red Hat

References

Exploit 1

Patch 1

Advisory 3

Other 6

  • TI-2024-01491 pgjdbc SQL Injection via line comment generation CVSS 3.1CRITICAL 10.0
  • TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
  • TI-2022-13237 SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc CVSS 3.1HIGH 8.0
  • TI-2022-09860 In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call… CVSS 3.1CRITICAL 9.8
  • TI-2026-30519 pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS CVSS 3.1HIGH 7.5
  • TI-2025-31226 pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration CVSS 3.1HIGH 8.2
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences