Source: libpgjava Version: 42.4.0-1 Severity: important Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for libpgjava. CVE-2022-31197[0]: | PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to | connect to a PostgreSQL database using standard, database independent | Java code. The PGJDBC implementation of the | `java.sql.ResultRow.refreshRow()` method is not performing escaping of | column names so a malicious column name that contains a statement | terminator, e.g. `;`, could lead to SQL injection. This could lead to | executing additional SQL commands as the application's JDBC user. User | applications that do not invoke the `ResultSet.refreshRow()` method | are not impacted. User application that do invoke that method are | impacted if the underlying database that they are querying via their | JDBC application may be under the control of an attacker. The attack | requires the attacker to trick the user into executing SQL against a | table name who's column names would contain the malicious SQL and | subsequently invoke the `refreshRow()` method on the ResultSet. Note | that the application's JDBC user and the schema owner need not be the | same. A JDBC application that executes as a privileged user querying | database schemas owned by potentially malicious less-privileged users | would be vulnerable. In that situation it may be possible for the | malicious user to craft a schema that causes the application to | execute commands as the privileged user. Patched versions will be | released as `42.2.26` and `42.4.1`. Users are advised to upgrade. | There are no known workarounds for this issue. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2022-31197 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31197 [1] https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-r38f-c4h4-hqq2https://github.com/pgjdbc/pgjdbc/commit/739e599d52ad80f8dcd6efedc6157859b1a9d637 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
