CVE catalog

CVE-2022-26520

libpgjava: CVE-2022-26520

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
3.00% · Oct 25, 2026

In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibpgjavasid42.7.14-1fixed
Debianlibpgjavaforky42.7.14-1fixed
Debianlibpgjavatrixie42.7.7-1fixed
Debianlibpgjavabookworm42.5.5-0+deb12u1fixed
Suseongres-scrammanager server module 4.22.1-150300.3.3.4fixed
Suseongres-stringprepmanager server module 4.21.1-150300.7.3.4fixed
Susepostgresql-jdbcmanager server module 4.242.2.25-150300.3.5.2fixed
Suseongres-scramlinux enterprise module for server applications 15 sp32.1-150300.3.3.4fixed
Suseongres-stringpreplinux enterprise module for server applications 15 sp31.1-150300.7.3.4fixed
Susepostgresql-jdbclinux enterprise module for server applications 15 sp342.2.25-150300.3.5.2fixed
Opensuseongres-scramleap 15.32.1-150300.3.3.4fixed
Opensuseongres-stringprepleap 15.31.1-150300.7.3.4fixed
Opensusepostgresql-jdbcleap 15.342.2.25-150300.3.5.2fixed
Susepostgresql-jdbclinux enterprise module for server applications 15 sp442.2.25-150400.3.3.2fixed
Opensusepostgresql-jdbcleap 15.442.2.25-150400.3.3.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibpgjavasourcesid42.3.3-1not yet assignedNot reportedNot reported
Debianlibpgjavasourceforky42.3.3-1not yet assignedNot reportedNot reported
Debianlibpgjavasourcetrixie42.3.3-1not yet assignedNot reportedNot reported
Debianlibpgjavasourcebookworm42.3.3-1not yet assignedNot reportedNot reported
Suseongres-scramrpmmanager server module 4.22.1-150300.3.3.4Not reportedSUSE-FU-2022:2794-1Not reported
Suseongres-stringpreprpmmanager server module 4.21.1-150300.7.3.4Not reportedSUSE-FU-2022:2794-1Not reported
Susepostgresql-jdbcrpmmanager server module 4.242.2.25-150300.3.5.2Not reportedSUSE-FU-2022:2794-1Not reported
Suseongres-scramrpmlinux enterprise module for server applications 15 sp32.1-150300.3.3.4Not reportedSUSE-FU-2022:2794-1Not reported
Suseongres-stringpreprpmlinux enterprise module for server applications 15 sp31.1-150300.7.3.4Not reportedSUSE-FU-2022:2794-1Not reported
Susepostgresql-jdbcrpmlinux enterprise module for server applications 15 sp342.2.25-150300.3.5.2Not reportedSUSE-FU-2022:2794-1Not reported
Opensuseongres-scramrpmleap 15.32.1-150300.3.3.4Not reportedSUSE-FU-2022:2794-1Not reported
Opensuseongres-stringpreprpmleap 15.31.1-150300.7.3.4Not reportedSUSE-FU-2022:2794-1Not reported
Opensusepostgresql-jdbcrpmleap 15.342.2.25-150300.3.5.2Not reportedSUSE-FU-2022:2794-1Not reported
Susepostgresql-jdbcrpmlinux enterprise module for server applications 15 sp442.2.25-150400.3.3.2Not reportedSUSE-SU-2022:2655-1Not reported
Opensusepostgresql-jdbcrpmleap 15.442.2.25-150400.3.3.2Not reportedSUSE-SU-2022:2655-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libpostgresql-jdbc-java]Fixed

    Source package: [libpgjava]

    Details (2)

    • 42.5.5-0+deb12u1 · all · bookworm

      Fixed · Fixed: 42.3.3-1

      dsa · libpgjava · debian · bookworm

    • 42.5.5-0+deb12u1 · all · bookworm

      Fixed · Fixed: 42.3.3-1

      dsa · libpgjava · debian · bookworm

  • [libpostgresql-jdbc-java-doc]Fixed

    Source package: [libpgjava]

    Details (2)

    • 42.5.5-0+deb12u1 · all · bookworm

      Fixed · Fixed: 42.3.3-1

      dsa · libpgjava · debian · bookworm

    • 42.5.5-0+deb12u1 · all · bookworm

      Fixed · Fixed: 42.3.3-1

      dsa · libpgjava · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]