pgjdbc Arbitrary File Write Vulnerability

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

not scored

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Overview The connection properties for configuring a pgjdbc connection are not meant to be exposed to an unauthenticated attacker. While allowing an attacker to specify arbitrary connection properties could lead to a compromise of a system, that's a defect of an application that allows unauthenticated attackers that level of control. It's not the job of the pgjdbc driver to decide whether a given log file location is acceptable. End user applications that use the pgjdbc driver must ensure that filenames are valid and restrict unauthenticated attackers from being able to supply arbitrary values. That's not specific to the pgjdbc driver either, it would be true for any library that can write to the application's local file system. While we do not consider this a security issue with the driver, we have decided to remove the loggerFile and loggerLevel connection properties in the next release of the driver. Removal of those properties does not make exposing the JDBC URL or connection…

Published by the source

16 Feb 2022, 00:08 UTC

Last modified by the source

22 Jan 2024, 19:35 UTC

Source last checked

26 Oct 2026, 16:25 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-673j-qm5f-xpv8

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-673j-qm5f-xpv8

Advisory: pgjdbc Arbitrary File Write Vulnerability
IDs: GHSA-673j-qm5f-xpv8
Record: https://patchnext.com/advisories/ghsa-673j-qm5f-xpv8 (revision 1, source checked 26 Oct 2026, 16:25 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Unrated
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: org.postgresql:postgresql 42.3.3. A vendor fix does not mean a deployment is fixed.

## Affected components
- Maven org.postgresql:postgresql: affected >= 42.1.0, < 42.3.3; fixed in 42.3.3

## Suggested inspection (read-only)
- Maven org.postgresql:postgresql: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on org.postgresql:postgresql.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-673j-qm5f-xpv8 (GitHub-reviewed advisory GHSA-673j-qm5f-xpv8 lists affected ranges: Maven org.postgresql:postgresql >=42.1.0 <42.3.3)

Commands are suggestions: review each one before running it.