USN-5238-1 libpgjava vulnerability

It was discovered that PostgreSQL JDBC Driver incorrectly handled certain requests from external entities. A remote attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code...

PT-2022-20605 · Databasir · Databasir

Name of the Vulnerable Software and Affected Versions: Databasir versions 1.06 and earlier Description: The issue allows attackers to perform Server-Side Request Forgery SSRF by sending a single HTTP POST request to create a databaseType. This is achieved by supplying a jdbcDriverFileUrl that...

The vulnerability of the JDBC driver of the Apache Calcite framework allows a hacker to execute arbitrary code.

The vulnerability of the JDBC framework driver of Apache Calcite Avatica is related to the use of uninitialized objects during the processing of the httpclientimpl parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

SQL Injection

PostgreSQL JDBC Driver is vulnerable to SQL Injection. The vulnerability exists in java.sql.ResultRow.RefreshRow function because it's not properly escaping column names which allows a remote attacker to inject and execute malicious sql code into the system...

CVE-2022-31197

PostgreSQL JDBC Driver PgJDBC for short allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the java.sql.ResultRow.refreshRow method is not performing escaping of column names so a malicious column name that contain...

CVE-2022-31197

PostgreSQL JDBC Driver PgJDBC for short allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the java.sql.ResultRow.refreshRow method is not performing escaping of column names so a malicious column name that contain...

[SECURITY] [DSA 5196-1] libpgjava security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5196-1 [email protected] https://www.debian.org/security/ Markus Koschany July 31, 2022 https://www.debian.org/security/faq -...

Debian DSA-5196-1 : libpgjava - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5196 advisory. - PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE. CVE-2020-13692 - pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in th...

Apache Calcite Code Injection Vulnerability

Apache Calcite is an open source framework from the US Apache Apache Foundation for building databases and data management systems. A code injection vulnerability exists in the Apache Calcite Avatica JDBC driver, which stems from the fact that classes are not verified to implement the expected...

GHSA-W7F5-JRPR-5C2M Apache Calcite Avatica JDBC driver arbitrary code execution

Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...

CVE-2022-36364

Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...

CVE-2022-36364

Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...

Code injection

Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...

CVE-2022-36364 Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vector

Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary...

CVE-2022-36364

Apache Calcite Avatica JDBC driver is affected by CVE-2022-36364 due to insecure dynamic instantiation of httpclient_impl classes without validating they implement the expected interface, enabling potential code execution loaded from arbitrary classes. The issue is addressed starting with Avatica...

EulerOS 2.0 SP8 : postgresql-jdbc (EulerOS-SA-2022-1946)

According to the versions of the postgresql-jdbc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security...

Security Bulletin: Vulnerability in PostgreSQL may affect IBM Spectrum Copy Data Management

Summary PostgreSQL could allow a remote attacker to gain unauthorized access to the system which may affect IBM Spectrum Copy Data Management. Vulnerability Details IBM X-Force ID: 220313 DESCRIPTION: PostgreSQL JDBC Driver could allow a remote attacker to gain unauthorized access to the system,...

Debian DLA-3018-1 : libpgjava - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-3018 advisory. - pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the...

[SECURITY] [DLA 3018-1] libpgjava security update

Debian LTS Advisory DLA-3018-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany May 20, 2022 https://wiki.debian.org/LTS Package : libpgjava Version : 9.4.1212-1+deb9u1 CVE ID : CVE-2022-21724 It was found that libpgjava, the official PostgreSQL JDBC Driver, would ...

Unescaped parameters in the PostgreSQL JDBC driver

Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standardconformingstrings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to...