CVE-2023-25158
Critical
Description
GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations. Users are advised to upgrade to either version 27.4 or to 28.2 to resolve this issue. Users unable to upgrade may disable `encode functions` for PostGIS DataStores or enable `prepared statements` for JDBCDataStores as a partial mitigation.
SeverityCritical
CVSS9.8
Exploit probability—
ProductGeotools
PublishedFeb 21, 2023
First seenFeb 21, 2023
Weakness typeCWE-89SQL injection
How to fix
Update
- geotools geotools24.7, 25.7, 26.7, 27.4, 28.2 or later
- org.geotools:gt-jdbc28.2, 27.4, 26.7, 25.7, 24.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| geotools geotools | v < 24.7, 25.0 ≤ v < 25.7, 26.0 ≤ v < 26.7, 27.0 ≤ v < 27.4, 28.0 ≤ v < 28.2 | 24.7, 25.7, 26.7, 27.4, 28.2 |
| org.geotools:gt-jdbcMaven | 28.0 ≤ v < 28.2, 27.0 ≤ v < 27.4, 26.0 ≤ v < 26.7, 25.0 ≤ v < 25.7, v < 24.7 | 28.2, 27.4, 26.7, 25.7, 24.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.