CVE catalog
CVE-2022-21724
libpgjava: CVE-2022-21724
- Severity
- High · CVSS 7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 3.09% · Oct 25, 2026
pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libpgjava | sid | 42.7.14-1 | fixed |
| Debian | libpgjava | forky | 42.7.14-1 | fixed |
| Debian | libpgjava | trixie | 42.7.7-1 | fixed |
| Debian | libpgjava | bookworm | 42.5.5-0+deb12u1 | fixed |
| Suse | release-notes-susemanager-proxy | manager proxy 4.1 | 4.1.15-150200.3.56.1 | fixed |
| Suse | release-notes-susemanager-proxy | manager retail branch server 4.1 | 4.1.15-150200.3.56.1 | fixed |
| Suse | release-notes-susemanager | manager server 4.1 | 4.1.15-150200.3.80.1 | fixed |
| Ubuntu | libpgjava | 14.04 | 9.2-1002-1 | vulnerable |
| Ubuntu | libpgjava | 16.04 | 9.2-1002-1 | vulnerable |
| Ubuntu | libpgjava | pro | 42.2.6-1 | vulnerable |
| Ubuntu | libpgjava | pro | 42.2.8-1 | vulnerable |
| Ubuntu | libpgjava | pro | 42.2.9-1 | vulnerable |
| Ubuntu | libpgjava | pro | 42.2.10-1 | vulnerable |
| Ubuntu | libpgjava | pro | 42.2.10-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | libpgjava | 22.04 | 42.2.23-1 | vulnerable |
| Ubuntu | libpgjava | 22.04 | 42.2.24-1 | vulnerable |
| Ubuntu | libpgjava | 22.04 | 42.3.1-1 | vulnerable |
| Ubuntu | libpgjava | 22.04 | 42.3.2-1 | vulnerable |
| Ubuntu | libpgjava | 22.04 | 42.3.3-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libpgjava | source | sid | 42.3.2-1 | not yet assigned | Not reported | Not reported |
| Debian | libpgjava | source | forky | 42.3.2-1 | not yet assigned | Not reported | Not reported |
| Debian | libpgjava | source | trixie | 42.3.2-1 | not yet assigned | Not reported | Not reported |
| Debian | libpgjava | source | bookworm | 42.3.2-1 | not yet assigned | Not reported | Not reported |
| Suse | release-notes-susemanager-proxy | rpm | manager proxy 4.1 | 4.1.15-150200.3.56.1 | Not reported | SUSE-SU-2022:2143-1 | Not reported |
| Suse | release-notes-susemanager-proxy | rpm | manager retail branch server 4.1 | 4.1.15-150200.3.56.1 | Not reported | SUSE-SU-2022:2143-1 | Not reported |
| Suse | release-notes-susemanager | rpm | manager server 4.1 | 4.1.15-150200.3.80.1 | Not reported | SUSE-SU-2022:2143-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libpostgresql-jdbc-java]Fixed
Source package: [libpgjava]
Details (2)
42.5.5-0+deb12u1· all · bookwormFixed · Fixed:
42.3.2-1dsa · libpgjava · debian · bookworm
42.5.5-0+deb12u1· all · bookwormFixed · Fixed:
42.3.2-1dsa · libpgjava · debian · bookworm
- [libpostgresql-jdbc-java-doc]Fixed
Source package: [libpgjava]
Details (2)
42.5.5-0+deb12u1· all · bookwormFixed · Fixed:
42.3.2-1dsa · libpgjava · debian · bookworm
42.5.5-0+deb12u1· all · bookwormFixed · Fixed:
42.3.2-1dsa · libpgjava · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_2143-1.json]
- [https://osv.dev/vulnerability/DLA-3018-1]
- [https://osv.dev/vulnerability/DSA-5196-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:2143-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2022-21724]
- [https://security-tracker.debian.org/tracker/CVE-2022-21724]
- [https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21724.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0607.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]