CVE-2022-31197 - SQL Injection

Abstract

PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet.

Affected Products/Versions

Mitigation

N/A

Detail

CVE-2022-31197

Severity: High

CVSS Score: 8.0

The PostgreSQL JDBC Driver third-party library used by Oxygen XML products is an affected version mentioned in CVE-2022-31197 vulnerability description. However, Oxygen XML products do not invoke the `ResultSet.refreshRow()` method. For that reason, we have rated the severity level for our products as low.

Starting with Oxygen Feedback version 2.1.3 build 2022091217, the PostgreSQL JDBC Driver was updated to version 42.4.1, which includes a fix for CVE-2022-31197.

Starting with Oxygen Content Fusion 5.0.1 build 2022092005, the PostgreSQL JDBC Driver was updated to version 42.4.1, which includes a fix for CVE-2022-31197.