CVE-2022-26520
Critical
Description
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties
SeverityCritical
CVSS9.8
Exploit probability—
Product
Postgresql Jdbc Driver
PublishedMar 10, 2022
First seenMar 10, 2022
How to fix
Update
- postgresql postgresql_jdbc_driver42.3.3 or later
- org.postgresql:postgresql42.3.3 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postgresql postgresql_jdbc_driver | 42.1.0 ≤ v ≤ 42.1.4, 42.3.0 ≤ v < 42.3.3 | 42.3.3 |
| debian debian_linux | 10.0, 11.0 | — |
| org.postgresql:postgresqlMaven | 42.1.0 ≤ v < 42.3.3 | 42.3.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.