CVE-2022-21724
- Source
- https://cve.org/CVERecord?id=CVE-2022-21724
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-21724.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-21724
- Aliases
- Downstream
- Related
- Published
- 2022-02-02T11:48:52Z
- Modified
- 2026-02-03T07:32:47.029451Z
- Severity
-
- 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Unchecked Class Instantiation when providing Plugin Classes
- Details
-
pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via
authenticationPluginClassName,sslhostnameverifier,socketFactory,sslfactory,sslpasswordcallbackconnection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue. - Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21724.json", "cna_assigner": "GitHub_M" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21724.json
- https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-v7wg-cpwc-24m4
- https://lists.debian.org/debian-lts-announce/2022/05/msg00027.html
- https://lists.debian.org/debian-lts-announce/2022/05/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVEO7BEFXPBVHSPYL3YKQWZI6DYXQLFS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVEO7BEFXPBVHSPYL3YKQWZI6DYXQLFS/
- https://nvd.nist.gov/vuln/detail/CVE-2022-21724
- https://security.netapp.com/advisory/ntap-20220311-0005/
- https://www.debian.org/security/2022/dsa-5196
Affected packages
Git / github.com/pgjdbc/pgjdbc
Database specific
vanir_signatures
[
{
"signature_type": "Function",
"source": "https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/core/SocketFactoryFactory.java",
"function": "getSslSocketFactory"
},
"id": "CVE-2022-21724-0c4f6d47",
"signature_version": "v1",
"digest": {
"function_hash": "290450761587819362508458380227539618688",
"length": 591.0
},
"deprecated": false
},
{
"signature_type": "Function",
"source": "https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/core/v3/AuthenticationPluginManager.java",
"function": "withEncodedPassword"
},
"id": "CVE-2022-21724-0cfe4bfa",
"signature_version": "v1",
"digest": {
"function_hash": "222706268560466953199390223600137580475",
"length": 624.0
},
"deprecated": false
},
{
"signature_type": "Line",
"source": "https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/ssl/LibPQFactory.java"
},
"id": "CVE-2022-21724-0d19d568",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"247153307125202517966389191868910347817",
"337273867374036537597999649309406185088",
"123722001280471412400572553548855150185",
"272287884890611757148340223552553729464"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"source": "https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/core/SocketFactoryFactory.java",
"function": "getSocketFactory"
},
"id": "CVE-2022-21724-21aa29c8",
"signature_version": "v1",
"digest": {
"function_hash": "82569256018608371493948748462819166520",
"length": 474.0
},
"deprecated": false
},
{
"signature_type": "Function",
"source": "https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/ssl/MakeSSL.java",
"function": "verifyPeerName"
},
"id": "CVE-2022-21724-2666e790",
"signature_version": "v1",
"digest": {
"function_hash": "247785280379720695647968187283442858902",
"length": 798.0
},
"deprecated": false
},
{
"signature_type": "Line",
"source": "https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/ssl/MakeSSL.java"
},
"id": "CVE-2022-21724-371aa2e3",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"105064538767946565337398519214479856787",
"118177348054607692228957837312719908662",
"191552652554875566014756358978076500233",
"149024308317787910602665500524029518127"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"source": "https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/util/ObjectFactory.java"
},
"id": "CVE-2022-21724-5a7acd74",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338650171237249186966863903787300345080",
"151092766617910071505210087011867609477",
"309665056626029339664491871200618391665",
"90615564188277283292967658230401432367",
"121240175271901900391337762927520645543",
"153469583615380959653249419035323075819",
"116865144532723521002117707774530989961",
"242525783600903278778696373213459998593",
"189624503096753410365579303373618329981",
"264480095332435089699772143145162971906",
"317171873722563787929998436855697622338"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"source": "https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/core/SocketFactoryFactory.java"
},
"id": "CVE-2022-21724-ad7d8f08",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"229904242425970102597619072866087206080",
"190707747687592485866445628135263963712",
"235540626295633169561707113158385190104",
"242244592986707100051008614092602542493",
"46597894765066314966160569768148022037",
"174870187326730878683490924940997913850",
"141201046363425609065448232308242857667",
"229079515841055361096975455813425246743"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"source": "https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/util/ObjectFactory.java",
"function": "instantiate"
},
"id": "CVE-2022-21724-b2551161",
"signature_version": "v1",
"digest": {
"function_hash": "332884536894667235821184075494630984673",
"length": 717.0
},
"deprecated": false
},
{
"signature_type": "Line",
"source": "https://github.com/pgjdbc/pgjdbc/commit/728c04ee8d26dcc4bca51503c2e93ad87ef8ce87",
"target": {
"file": "pgjdbc/src/test/java/org/postgresql/test/util/ObjectFactoryTest.java"
},
"id": "CVE-2022-21724-b86adc97",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"77130334003739591410528152531258614322",
"166877801091010967619156607584439012760",
"301390549397643879277305003091212931605",
"238151149970343309112211087790418377211",
"300257285640816505899831457312930742508",
"94846620378077564826825539268529182323",
"77307137651297703369265630847279064765",
"199285849338706689811635068050099655656",
"243464814999577555506379422182077075919"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"source": "https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/core/v3/AuthenticationPluginManager.java"
},
"id": "CVE-2022-21724-d1c6ca31",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"66503424840584733458251601750372409661",
"174597814892594439636571041984062407092",
"104030770466586034485201533993165503113",
"224036711230398416415985865631825797976",
"289336234561907420986258651160307828821",
"98850025810154234432932198612748078617",
"81080676654946964497225467060361794558",
"40934962280104586082170245993597154436",
"188392370455379158597595050299131396130",
"71167797331723158813946506917815912310",
"210137953522200640621175449879169559039",
"253972741671819768950940124382102355587"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"source": "https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/ssl/LibPQFactory.java",
"function": "getCallbackHandler"
},
"id": "CVE-2022-21724-e7154bfb",
"signature_version": "v1",
"digest": {
"function_hash": "165199549980941808397409680013137867879",
"length": 526.0
},
"deprecated": false
},
{
"signature_type": "Function",
"source": "https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813",
"target": {
"file": "pgjdbc/src/main/java/org/postgresql/core/v3/AuthenticationPluginManager.java",
"function": "withPassword"
},
"id": "CVE-2022-21724-f786a486",
"signature_version": "v1",
"digest": {
"function_hash": "85165579289778437657249445803341173866",
"length": 816.0
},
"deprecated": false
}
]
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-21724.json"