VDB
CVE-2022-26520
CVE-2022-26520
PUBLISHED
CVSS 9.800000190734863 CRITICAL
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties
EPSS 3.00% · 86.9th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
3.00%
86.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | postgresql-jdbc-driver | 42.1.0, 42.3.0 |
| Bitnami | postgresql-jdbc-driver | 42.1.0, 42.3.0 |
Timeline
- Mar 7, 2022 CVE Published
- Mar 8, 2022 EPSS Score
- Apr 7, 2022 PoC Published
- Apr 29, 2022 EPSS Score
- Jun 19, 2022 EPSS Score
- Oct 2, 2022 EPSS Score
- Nov 23, 2022 EPSS Score
- Jan 13, 2023 EPSS Score
- Mar 6, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Jun 18, 2023 EPSS Score
- Aug 8, 2023 EPSS Score
References
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8 url
- https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3 url
- https://jdbc.postgresql.org/documentation/head/tomcat.html url
- https://nvd.nist.gov/vuln/detail/CVE-2022-26520 url
- https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc fix
- https://www.debian.org/security/2022/dsa-5196 advisory