CVE-2022-31197
published 2022-08-03CVE-2022-31197: PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC…
PriorityP275high8CVSS 3.1
AVNACLPRLUIRSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.66%
73.8th percentile
PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet. Note that the application's JDBC user and the schema owner need not be the same. A JDBC application that executes as a privileged user querying database schemas owned by potentially malicious less-privileged users would be vulnerable. In that situation it may be possible for the malicious user to craft a schema that causes the application to execute commands as the privileged user. Patched versions will be released as `42.2.26` and `42.4.1`. Users are advised to upgrade. There are no known workarounds for this issue.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | libpgjava | < libpgjava 42.4.1-1 (bookworm) | libpgjava 42.4.1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| pgjdbc | pgjdbc | — | — |
| pgjdbc | pgjdbc | — | — |
| postgresql | postgresql_jdbc_driver | < 42.2.26 | 42.2.26 |
| postgresql | postgresql_jdbc_driver | — | — |
| postgresql | postgresql_jdbc_driver | — | — |
| postgresql | postgresql_jdbc_driver | >= 42.3.0 < 42.3.7 | 42.3.7 |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: SQL injection occurs only when the application invokes `ResultSet.refreshRow()` on a ResultSet whose column names contain unescaped statement terminators (e.g. `;`). Monitor or audit code paths that call this method against untrusted schemas. ↗
- →Scope the attack surface: only applications whose JDBC user queries database schemas owned by potentially less-privileged or attacker-controlled users are exploitable. Audit privilege separation between JDBC users and schema owners. ↗
- →Applications that never call `ResultSet.refreshRow()` are NOT impacted — use this as a triage filter when assessing exposure. ↗
- ·Patched versions are 42.2.26 and 42.4.1. Any PgJDBC deployment running versions below these thresholds and invoking `ResultSet.refreshRow()` is vulnerable. ↗
- ·Red Hat Fuse Online (Syndesis) will NOT receive a fix for this flaw despite being affected. ↗
- ·Red Hat Enterprise Linux 8 packages (postgresql-jdbc and libreoffice:flatpak/libreoffice) are marked 'Will not fix', meaning those environments remain permanently exposed. ↗
CVSS provenance
nvdv3.18.0HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
osv8.0HIGH
vulncheck7.1HIGH
vendor_oracle8.0HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: General (PostgreSQL JDBC Driver) — CVE-2022-31197
vendor_oracle·2023-07-15·CVSS 8.0
CVE-2022-31197 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: General (PostgreSQL JDBC Driver) — CVE-2022-31197
Oracle Oracle Fusion Middleware Risk Matrix: General (PostgreSQL JDBC Driver) vulnerability
CVE: CVE-2022-31197
CVSS: 8.0
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
Red Hat
postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names
vendor_redhat·2022-08-03·CVSS 7.1
CVE-2022-31197 [HIGH] CWE-89 postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names
postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names
PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker.
Debian
CVE-2022-31197: libpgjava - PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a P...
vendor_debian·2022·CVSS 7.1
CVE-2022-31197 [HIGH] CVE-2022-31197: libpgjava - PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a P...
PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a t
GHSA
PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names
ghsa·2022-08-06
CVE-2022-31197 [HIGH] CWE-89 PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names
PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names
### Impact
_What kind of vulnerability is it? Who is impacted?_
The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user.
User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted.
User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL
OSV
PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names
osv·2022-08-06
CVE-2022-31197 [HIGH] PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names
PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names
### Impact
_What kind of vulnerability is it? Who is impacted?_
The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user.
User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted.
User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL
OSV
CVE-2022-31197: PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code
osv·2022-08-03·CVSS 8.0
CVE-2022-31197 [HIGH] CVE-2022-31197: PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code
PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a t
VulnCheck
postgresql postgresql_jdbc_driver Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
vulncheck·2022·CVSS 7.1
CVE-2022-31197 [HIGH] postgresql postgresql_jdbc_driver Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
postgresql postgresql_jdbc_driver Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application ma
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/pgjdbc/pgjdbc/commit/739e599d52ad80f8dcd6efedc6157859b1a9d637https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-r38f-c4h4-hqq2https://lists.debian.org/debian-lts-announce/2022/10/msg00009.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6WHUADTZBBQLVHO4YG4XCWDGWBT4LRP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTFE6SV33P5YYU2GNTQZQKQRVR3GYE4S/https://github.com/pgjdbc/pgjdbc/commit/739e599d52ad80f8dcd6efedc6157859b1a9d637https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-r38f-c4h4-hqq2https://lists.debian.org/debian-lts-announce/2022/10/msg00009.htmlhttps://lists.debian.org/debian-lts-announce/2024/12/msg00017.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6WHUADTZBBQLVHO4YG4XCWDGWBT4LRP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTFE6SV33P5YYU2GNTQZQKQRVR3GYE4S/
2022-08-03
Published
Exploited in the wild