In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call
    java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel
    connection properties. An example situation is that an attacker could create an executable JSP file under
    a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a
    vulnerability for any application to use the pgjdbc driver with untrusted connection properties
    (CVE-2022-26520)

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2655-1 advisory.

    - CVE-2022-26520: Fixed arbitrary File Write Vulnerability (bsc#1197356)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5196 advisory.

  - PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. (CVE-2020-13692)

  - pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql     database while doing security research. The system using the postgresql library will be attacked when     attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names     provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`,     `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements     the expected interface before instantiating the class. This can lead to code execution loaded via     arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this     issue. (CVE-2022-21724)

  - ** DISPUTED ** In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call     java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel     connection properties. An example situation is that an attacker could create an executable JSP file under     a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a     vulnerability for any application to use the pgjdbc driver with untrusted connection properties.
    (CVE-2022-26520)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
411732	SCA: security update for org.postgresql:postgresql (GHSA-727h-hrw8-jg8q)	Tenable Cloud Security	SCA Checks	critical
411732	SCA: security update for org.postgresql:postgresql (GHSA-727h-hrw8-jg8q)	Tenable Self-Hosted Container Security	SCA Checks	critical
163815	SUSE SLES15 / openSUSE 15 Security Update : postgresql-jdbc (SUSE-SU-2022:2655-1)	Nessus	SuSE Local Security Checks	critical
163651	Debian DSA-5196-1 : libpgjava - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2022-26520

critical

Tenable Plugins

critical

critical

critical

critical