Skip to content
OpenAdvisories
Critical DLA-3995-1 3 CVEs

libpgjava - security update

Published Dec 16, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 libpgjava 42.2.15-1+deb11u2

Vulnerabilities 3

  • Critical 10.0
    CVE-2024-1597

    pgjdbc SQL Injection via line comment generation

    pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There mu…

    pgjdbc pgjdbc trino trino-plugin-opensearch Debian Ubuntu Alpine Wolfi Maven
  • High 7.1
    CVE-2022-31197

    SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc

    PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column n…

    pgjdbc pgjdbc libpgjava libpgjava Debian Ubuntu Alpine Wolfi Maven
  • Medium 4.7
    CVE-2022-41946

    TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc

    pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `PreparedStatemet.setBytea(int, InputStream)` will create a temporary file if the InputStream is larger th…

    pgjdbc pgjdbc libpgjava libpgjava Debian Ubuntu Alpine Maven