PostgreSQL Pgjdbc
By the Year
In 2024 there have been 0 vulnerabilities in PostgreSQL Pgjdbc . Pgjdbc did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 2 | 9.80 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Pgjdbc vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent PostgreSQL Pgjdbc Security Vulnerabilities
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties)
CVE-2022-26520
9.8 - Critical
- March 10, 2022
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties
pgjdbc is the offical PostgreSQL JDBC Driver
CVE-2022-21724
9.8 - Critical
- February 02, 2022
pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue.
Improper Initialization
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Debian Linux or by PostgreSQL? Click the Watch button to subscribe.
