Skip to content
OpenAdvisories
Medium ALSA-2023:0318 1 CVE

Moderate: postgresql-jdbc security update

Published Jan 23, 2023 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.

Security Fix(es):

* postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names (CVE-2022-31197)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 9 postgresql-jdbc 42.2.18-6.el9_1

Vulnerabilities 1

  • High 7.1
    CVE-2022-31197

    SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc

    PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column n…

    pgjdbc pgjdbc libpgjava libpgjava Debian Ubuntu Alpine Wolfi Maven

References

  • report
    https://access.redhat.com/security/cve/CVE-2022-31197
  • report
    https://bugzilla.redhat.com/2129428
  • advisory
    https://errata.almalinux.org/9/ALSA-2023-0318.html