SUSE update for postgresql-jdbc



Published: 2022-10-18
Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2022-31197
CWE-ID CWE-89
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
SUSE Linux Enterprise Storage
Operating systems & Components / Operating system

SUSE Linux Enterprise Module for SUSE Manager Server
Operating systems & Components / Operating system

SUSE Manager Retail Branch Server
Operating systems & Components / Operating system

openSUSE Leap
Operating systems & Components / Operating system

SUSE Manager Server
Operating systems & Components / Operating system

SUSE Manager Proxy
Operating systems & Components / Operating system

SUSE Linux Enterprise Server for SAP Applications
Operating systems & Components / Operating system

SUSE Linux Enterprise Server
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing
Operating systems & Components / Operating system

SUSE Linux Enterprise Module for Server Applications
Operating systems & Components / Operating system

postgresql-jdbc-javadoc
Operating systems & Components / Operating system package or component

postgresql-jdbc
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) SQL injection

EUVDB-ID: #VU66747

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-31197

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data within the java.sql.ResultRow.refreshRow() method when processing column names. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database using the statement terminator, e.g." ;".

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Update the affected package postgresql-jdbc to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Storage: 7.1

SUSE Linux Enterprise Module for SUSE Manager Server: 4.2

SUSE Manager Retail Branch Server: 4.2

openSUSE Leap: 15.3

SUSE Manager Server: 4.2

SUSE Manager Proxy: 4.2

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Server: 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP3

SUSE Linux Enterprise Module for Server Applications: 15-SP3

postgresql-jdbc-javadoc: before 42.2.25-150300.3.8.1

postgresql-jdbc: before 42.2.25-150300.3.8.1

CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20223613-1/


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###