CVE-2022-21724

Katalog CVE

CVSS 9.8 · Critical EPSS 3,1%

Kerentanan Improper Initialization pada postgresql jdbc driver, fedoraproject fedora +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue.

Rincian

Terbit di NVD

2 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-665: Improper Initialization

EPSS (30 hari)

3,1% peluang dieksploitasi; lebih tinggi dari 87,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813 patch · advisory pihak ketiga
• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-v7wg-cpwc-24m4 exploit · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/05/msg00027.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220311-0005/ advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5196 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVEO7BEFXPBVH...