CVE-2022-21724

pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue.

Affected products

Alt Linux, Astra Linux, Bitbucket, Jira, Red Os, Suse, Pgjdbc

Postgresql Postgresql Jdbc Driver

< 42.2.25, 42.3.2

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

3.0% (86th percentile)

Weakness

CWE-665

NVD status

Modified

Published

2022-02-02

No exploit for CVE-2022-21724 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.