Vulnerabilities > CVE-2022-31197

CVSS 8.0 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

postgresql

debian

fedoraproject

NVD

Published: 2022-08-03

Updated: 2024-11-21

Summary

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet. Note that the application's JDBC user and the schema owner need not be the same. A JDBC application that executes as a privileged user querying database schemas owned by potentially malicious less-privileged users would be vulnerable. In that situation it may be possible for the malicious user to craft a schema that causes the application to execute commands as the privileged user. Patched versions will be released as `42.2.26` and `42.4.1`. Users are advised to upgrade. There are no known workarounds for this issue.

Vulnerable Configurations

Part	Description	Count
Application	Postgresql Postgresql Postgresql Jdbc Driver - Postgresql Postgresql Jdbc Driver 8.1 Postgresql Postgresql Jdbc Driver 9.0-801 Postgresql Postgresql Jdbc Driver 9.1-901 Postgresql Postgresql Jdbc Driver 9.1-902 Postgresql Postgresql Jdbc Driver 9.2-1000 Postgresql Postgresql Jdbc Driver 9.2-1001 Postgresql Postgresql Jdbc Driver 9.2-1002 Postgresql Postgresql Jdbc Driver 9.2-1003 Postgresql Postgresql Jdbc Driver 9.2-1004 Postgresql Postgresql Jdbc Driver 9.3-1100 Postgresql Postgresql Jdbc Driver 9.3-1101 Postgresql Postgresql Jdbc Driver 9.3-1102 Postgresql Postgresql Jdbc Driver 9.3-1103 Postgresql Postgresql Jdbc Driver 9.4-1200 Postgresql Postgresql Jdbc Driver 9.4-1201 Postgresql Postgresql Jdbc Driver 9.4-1202 Postgresql Postgresql Jdbc Driver 9.4-1203 Postgresql Postgresql Jdbc Driver 9.4-1204 Postgresql Postgresql Jdbc Driver 9.4-1205 Postgresql Postgresql Jdbc Driver 9.4-1206 Postgresql Postgresql Jdbc Driver 9.4.1207 Postgresql Postgresql Jdbc Driver 9.4.1208 Postgresql Postgresql Jdbc Driver 9.4.1209 Postgresql Postgresql Jdbc Driver 9.4.1210 Postgresql Postgresql Jdbc Driver 9.4.1211 Postgresql Postgresql Jdbc Driver 9.4.1212 Postgresql Postgresql Jdbc Driver 42.0.0 Postgresql Postgresql Jdbc Driver 42.1.0 Postgresql Postgresql Jdbc Driver 42.1.1 Postgresql Postgresql Jdbc Driver 42.1.2 Postgresql Postgresql Jdbc Driver 42.1.3 Postgresql Postgresql Jdbc Driver 42.1.4 Postgresql Postgresql Jdbc Driver 42.2.0 Postgresql Postgresql Jdbc Driver 42.2.1 Postgresql Postgresql Jdbc Driver 42.2.2 Postgresql Postgresql Jdbc Driver 42.2.3 Postgresql Postgresql Jdbc Driver 42.2.4 Postgresql Postgresql Jdbc Driver 42.2.5 Postgresql Postgresql Jdbc Driver 42.2.6 Postgresql Postgresql Jdbc Driver 42.2.7 Postgresql Postgresql Jdbc Driver 42.2.8 Postgresql Postgresql Jdbc Driver 42.2.9 Postgresql Postgresql Jdbc Driver 42.2.10 Postgresql Postgresql Jdbc Driver 42.2.11 Postgresql Postgresql Jdbc Driver 42.2.12 Postgresql Postgresql Jdbc Driver 42.2.13 Postgresql Postgresql Jdbc Driver 42.2.14 Postgresql Postgresql Jdbc Driver 42.2.15 Postgresql Postgresql Jdbc Driver 42.2.16 Postgresql Postgresql Jdbc Driver 42.2.17 Postgresql Postgresql Jdbc Driver 42.2.18 Postgresql Postgresql Jdbc Driver 42.2.19 Postgresql Postgresql Jdbc Driver 42.2.20 Postgresql Postgresql Jdbc Driver 42.2.21 Postgresql Postgresql Jdbc Driver 42.2.22 Postgresql Postgresql Jdbc Driver 42.2.23 Postgresql Postgresql Jdbc Driver 42.2.24 Postgresql Postgresql Jdbc Driver 42.2.25 Postgresql Postgresql Jdbc Driver 42.4.0 Postgresql Postgresql Jdbc Driver 42.4.1 Postgresql Postgresql Jdbc Driver 42.3.0 Postgresql Postgresql Jdbc Driver 42.3.1 Postgresql Postgresql Jdbc Driver 42.3.2 Postgresql Postgresql Jdbc Driver 42.3.3 Postgresql Postgresql Jdbc Driver 42.3.4 Postgresql Postgresql Jdbc Driver 42.3.5 Postgresql Postgresql Jdbc Driver 42.3.6	102
OS	Debian Debian Debian Linux 10.0	1
OS	Fedoraproject Fedoraproject Fedora 35 Fedoraproject Fedora 36	2

Vulnerabilities > CVE-2022-31197 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2022-31197"}]}

Summary

Vulnerable Configurations

References

Vulnerabilities > CVE-2022-31197