CVE-2022-26520

描述

In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties

如何修補 CVE-2022-26520

要修補 CVE-2022-26520,請將受影響套件升級到下列已修補版本。

• —升級至 42.1.5 或更新版本
• —升級至 42.2.15-1+deb11u1 或更新版本
• —升級至 42.3.3 或更新版本
• —升級至 42.3.3 或更新版本

CVE-2022-26520 正在被利用嗎?

低 — EPSS 為 3.0%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• >= 42.1.0, < 42.1.5, >= 42.3.0, < 42.3.3
• from 0, < 42.2.15-1+deb11u1
• >= 42.1.0, < 42.3.3
• >= 42.1.0, < 42.3.3

CVSS 分數

參考連結(9)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-26520
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-26520
• PATCHgithub.com/pgjdbc/pgjdbc
• WEBgithub.com/pgjdbc/pgjdbc/commit/f6d47034a4ce292e1a659fa00963f6f713117064