CVE-2022-31197 — SQL Injection in Postgresql Jdbc Driver

CWE-89 — SQL Injection9 documents8 sources
Severity
8.0HIGHNVD
CNA7.1VulnCheck7.1
EPSS
3.6%
top 12.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Postgresql Jdbc DriverPgjdbcDebian Linux+1 more
Timeline
PublishedAug 3
Latest updateJul 15

Description

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `Resul…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9

Affected Packages2 packages

▶NVDpostgresql/postgresql_jdbc_driver42.3.0 — 42.3.7+3
▶CVEListV5pgjdbc/pgjdbc>= 42.2.0, < 42.2.26, >= 42.3.0, < 42.4.1+1

Also affects: Debian Linux 10.0, Fedora 35, 36

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
GHSA
PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names↗2022-08-06
▶
OSV
PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names↗2022-08-06
▶
OSV
CVE-2022-31197: PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code↗2022-08-03
▶
CVEList
SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc↗2022-08-03
▶
VulnCheck
postgresql postgresql_jdbc_driver Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')↗2022
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: General (PostgreSQL JDBC Driver) — CVE-2022-31197↗2023-07-15
▶
Red Hat
postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names↗2022-08-03
▶
Debian
CVE-2022-31197: libpgjava - PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a P...↗2022
▶
CVE-2022-31197 — SQL Injection in Postgresql | cvebase