Bug#1016662: libpgjava: CVE-2022-31197: SQL Injection in ResultSet.refreshRow() with malicious column names

[Salvatore Bonaccorso]

Source: libpgjava
Version: 42.4.0-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for libpgjava.

CVE-2022-31197[0]:
| PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to
| connect to a PostgreSQL database using standard, database independent
| Java code. The PGJDBC implementation of the
| `java.sql.ResultRow.refreshRow()` method is not performing escaping of
| column names so a malicious column name that contains a statement
| terminator, e.g. `;`, could lead to SQL injection. This could lead to
| executing additional SQL commands as the application's JDBC user. User
| applications that do not invoke the `ResultSet.refreshRow()` method
| are not impacted. User application that do invoke that method are
| impacted if the underlying database that they are querying via their
| JDBC application may be under the control of an attacker. The attack
| requires the attacker to trick the user into executing SQL against a
| table name who's column names would contain the malicious SQL and
| subsequently invoke the `refreshRow()` method on the ResultSet. Note
| that the application's JDBC user and the schema owner need not be the
| same. A JDBC application that executes as a privileged user querying
| database schemas owned by potentially malicious less-privileged users
| would be vulnerable. In that situation it may be possible for the
| malicious user to craft a schema that causes the application to
| execute commands as the privileged user. Patched versions will be
| released as `42.2.26` and `42.4.1`. Users are advised to upgrade.
| There are no known workarounds for this issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-31197
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31197
[1] https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-r38f-c4h4-hqq2https://github.com/pgjdbc/pgjdbc/commit/739e599d52ad80f8dcd6efedc6157859b1a9d637

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore