Skip to content
OpenAdvisories
Medium RLSA-2023:0318 1 CVE

Moderate: postgresql-jdbc security update

Published Jan 23, 2023 · Updated Feb 4, 2026

Ecosystem: Rocky Linux

Summary

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.

Security Fix(es):

* postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names (CVE-2022-31197)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 postgresql-jdbc 0:42.2.18-6.el9_1

Vulnerabilities 1

  • High 7.1
    CVE-2022-31197

    SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc

    PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column n…

    pgjdbc pgjdbc libpgjava libpgjava Debian Ubuntu Alpine Wolfi Maven

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2129428