Skip to content
OpenAdvisories
High RHSA-2023:0318 1 CVE

Red Hat Security Advisory: postgresql-jdbc security update

Published Sep 16, 2024 · Updated Oct 2, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream postgresql-jdbc 0:42.2.18-6.el9_1

Vulnerabilities 1

  • High 7.1
    CVE-2022-31197

    SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc

    PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column n…

    pgjdbc pgjdbc libpgjava libpgjava Debian Ubuntu Alpine Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2129428
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0318.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-31197
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-31197
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-31197
  • article
    https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-r38f-c4h4-hqq2