Skip to content
OpenAdvisories
High · 7.0 CVE-2022-21724 BIT-postgresql-jdbc-driver-2022-21724EUVD-2022-1192GHSA-v7wg-cpwc-24m4

Unchecked Class Instantiation when providing Plugin Classes

Published Feb 2, 2022 · Updated May 5, 2025 · Assigned by GitHub_M

Package: java-postgresql-jdbc Package: libpgjava Package: libpgjava Package: mariadb-10.11 Package: mariadb-10.11-backup Package: mariadb-10.11-bench Package: mariadb-10.11-client Package: mariadb-10.11-dev Package: mariadb-10.11-doc Package: mariadb-10.11-embedded Package: mariadb-10.11-oci-entrypoint Package: mariadb-10.6 Package: mariadb-10.6-backup Package: mariadb-10.6-bench Package: mariadb-10.6-dev Package: mariadb-10.6-doc Package: mariadb-10.6-embedded Package: mariadb-10.6-oci-entrypoint Package: mariadb-10.6-test Package: mariadb-11.2 Package: mariadb-11.2-backup Package: mariadb-11.2-bench Package: mariadb-11.2-client Package: mariadb-11.2-dev Package: mariadb-11.2-doc Package: mariadb-11.2-embedded Package: mariadb-11.2-oci-entrypoint Package: org.postgresql:postgresql Ecosystem: Alpine Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libpgjava 42.3.2-1 —
Debian 13 libpgjava 42.3.2-1 —
Debian 12 libpgjava 42.3.2-1 —
Debian 11 libpgjava 42.2.15-1+deb11u1 DSA-5196-1
Debian 10 libpgjava 42.2.5-2+deb10u1 DSA-5196-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 9 libpgjava 9.4.1212-1+deb9u1 DLA-3018-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS libpgjava No fix yet —
Ubuntu 14.04 LTS libpgjava No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS libpgjava No fix yet —
Ubuntu Pro 18.04 LTS libpgjava No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Manager Server Module 4.1 golang-github-QubitProducts-exporter_exporter 0.4.0-150200.6.12.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 golang-github-lusitaniae-apache_exporter 0.7.0-150200.2.6.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 golang-github-prometheus-node_exporter 1.3.0-150200.3.9.3 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 patterns-suse-manager 4.1-150200.6.12.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 postgresql-jdbc 42.2.10-150200.3.8.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 prometheus-exporters-formula 0.9.5-150200.3.31.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 prometheus-formula 0.3.7-150200.3.21.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 py27-compat-salt 3000.3-150200.6.24.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 spacecmd 4.1.18-150200.4.39.3 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 spacewalk-backend 4.1.31-150200.4.50.4 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 spacewalk-java 4.1.46-150200.3.71.5 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 spacewalk-setup 4.1.11-150200.3.18.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 spacewalk-utils 4.1.20-150200.3.30.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 spacewalk-web 4.1.34-150200.3.47.6 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 subscription-matcher 0.28-150200.3.15.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 susemanager 4.1.36-150200.3.52.1 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 susemanager-doc-indexes 4.1-150200.11.55.4 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 susemanager-docs_en 4.1-150200.11.55.2 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 susemanager-schema 4.1.26-150200.3.45.4 SUSE-SU-2022:2145-1
SUSE Manager Server Module 4.1 susemanager-sls 4.1.36-150200.3.64.2 SUSE-SU-2022:2145-1
SUSE Manager Server 4.1 release-notes-susemanager 4.1.15-150200.3.80.1 SUSE-SU-2022:2143-1
SUSE Manager Retail Branch Server 4.1 release-notes-susemanager-proxy 4.1.15-150200.3.56.1 SUSE-SU-2022:2143-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Manager Proxy 4.1 release-notes-susemanager-proxy 4.1.15-150200.3.56.1 SUSE-SU-2022:2143-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 java-postgresql-jdbc 42.2.25-r0 —
Alpine v3.23 java-postgresql-jdbc 42.2.25-r0 —
Alpine v3.22 java-postgresql-jdbc 42.2.25-r0 —
Alpine v3.21 java-postgresql-jdbc 42.2.25-r0 —
Alpine v3.20 java-postgresql-jdbc 42.2.25-r0 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 java-postgresql-jdbc 42.2.25-r0 —
Alpine v3.18 java-postgresql-jdbc 42.2.25-r0 —
Alpine v3.17 java-postgresql-jdbc 42.2.25-r0 —
Alpine v3.16 java-postgresql-jdbc 42.2.25-r0 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling mariadb-10.11 +7 10.11.8-r2 —
Wolfi rolling mariadb-10.6 +7 10.6.18-r2 —
Wolfi rolling mariadb-11.2 +7 11.2.3-r2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.postgresql:postgresql >= 9.4.1208, < 42.2.25 42.2.25 GHSA-v7wg-cpwc-24m4
Maven org.postgresql:postgresql >= 42.3.0, < 42.3.2 42.3.2 GHSA-v7wg-cpwc-24m4

Advisories 7

References