CVE-2022-26520

** DISPUTED ** In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties.

In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties

TuxCare rebuilt org.postgresql:postgresql to address 3 CVEs. Fixed in 42.2.16-tuxcare.1.

In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties

Overview

The connection properties for configuring a pgjdbc connection are not meant to be exposed to an unauthenticated attacker. While allowing an attacker to specify arbitrary connection properties could lead to a compromise of a system, that's a defect of an application that allows unauthenticated attackers that level of control.

It's not the job of the pgjdbc driver to decide whether a given log file location is acceptable. End user applications that use the pgjdbc driver must ensure that filenames are valid and restrict unauthenticated attackers from being able to supply arbitrary values. That's not specific to the pgjdbc driver either, it would be true for any library that can write to the application's local file system.

While we do not consider this a security issue with the driver, we have decided to remove the loggerFile and loggerLevel connection properties in the next release of the driver. Removal of those properties does not make exposing the JDBC URL or connection properties to an attacker safe and we continue to suggest that applications do not allow untrusted users to specify arbitrary connection properties. We are removing them to prevent misuse and their functionality can be delegated to java.util.logging.

If you identify an application that allows remote users to specify a complete JDBC URL or properties without validating it's contents, we encourage you to notify the application owner as that may be a security defect in that specific application.

Impact

It is possible to specify an arbitrary filename in the loggerFileName connection parameter "jdbc:postgresql://localhost:5432/test?user=test&password=test&loggerLevel=DEBUG&loggerFile=./blah.jsp&<%Runtime.getRuntime().exec(request.getParameter("i"));%>"

This creates a valid JSP file which could lead to a Remote Code Execution

Patches

LoggerFile implementation has been removed and will be ignored by the driver, fixed in 42.3.3

Workarounds

sanitize the inputs to the driver

Reported by Allan Lou [email protected]

In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties.

These are all security issues fixed in the postgresql-jdbc-42.2.25-2.1 package on the GA media of openSUSE Tumbleweed.

This feature update for ongres-scram, ongres-stringprep, postgresql-jdbc provides:

ongres-scram:

• Upgrade from version 1.0.0-beta.2 to version 2.1. (jsc#SLE-23994)
  • Add standard SASLPrep (bsc#1196693, jsc#SLE-23994)
  • Failover to bouncy castle implementation of PBKDF2WithHmacSHA256 to support Oracle JDK 7
  • Updated saslprep to version 1.1 to remove a build dependency coming from the stringprep module

ongres-stringprep:

• Introduce ongres-stringprep 1.1 as dependency of ongres-scram. (bsc#1196693, jsc#SLE-23994)

postgresql-jdbc:

• CVE-2022-26520: Fixed arbitrary File Write Vulnerability (bsc#1197356)
• Upgrade postgresql-jdbc from version 42.2.16 to version 42.2.25 (jsc#SLE-23994)
  • Use SASLprep normalization for SCRAM authentication and fixes issues with spaces in passwords. (bsc#1196693)

This update for SUSE Manager 4.1.15 Release Notes provides the following additions:

Release notes for SUSE Manager:

• Update to 4.1.15
  • Salt has been upgraded to 3004 version
  • Grafana has been upgraded to 8.3.5
  • Postgres exporter has been upgraded to 0.10.0
  • Alertmanager has been upgraded to 0.23.0
  • Node exporter has been upgraded 1.3.0
  • CVEs fixed: CVE-2022-21724, CVE-2022-21952, CVE-2022-31248, CVE-2022-26520
  • Bugs mentioned: bsc#1182742, bsc#1189501, bsc#1190535, bsc#1192850, bsc#1193032 bsc#1193238, bsc#1193707, bsc#1194262, bsc#1194447, bsc#1194594 bsc#1194909, bsc#1195561, bsc#1196338, bsc#1196407, bsc#1196702 bsc#1196704, bsc#1197356, bsc#1197429, bsc#1197438, bsc#1197488 bsc#1198221, bsc#1198356, bsc#1198686, bsc#1198914, bsc#1199036 bsc#1199142, bsc#1199149, bsc#1199512, bsc#1199528, bsc#1199629 bsc#1199677, bsc#1199888

Release notes for SUSE Manager proxy:

• Update to 4.1.15
  • Salt has been upgraded to 3004 version
  • Bugs mentioned: bsc#1190535, bsc#1193238, bsc#1194447, bsc#1194594, bsc#1194909 bsc#1196338, bsc#1196704, bsc#1199142, bsc#1199528

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-lusitaniae-apache_exporter:

• Require building with Go 1.15
• Add %license macro for LICENSE file

golang-github-prometheus-node_exporter:

• CVE-2022-21698: Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24238, jsc#SLE-24239)
• Update to 1.3.0
  • [CHANGE] Add path label to rapl collector #2146
  • [CHANGE] Exclude filesystems under /run/credentials #2157
  • [CHANGE] Add TCPTimeouts to netstat default filter #2189
  • [FEATURE] Add lnstat collector for metrics from /proc/net/stat/ #1771
  • [FEATURE] Add darwin powersupply collector #1777
  • [FEATURE] Add support for monitoring GPUs on Linux #1998
  • [FEATURE] Add Darwin thermal collector #2032
  • [FEATURE] Add os release collector #2094
  • [FEATURE] Add netdev.address-info collector #2105
  • [FEATURE] Add clocksource metrics to time collector #2197
  • [ENHANCEMENT] Support glob textfile collector directories #1985
  • [ENHANCEMENT] ethtool: Expose node_ethtool_info metric #2080
  • [ENHANCEMENT] Use include/exclude flags for ethtool filtering #2165
  • [ENHANCEMENT] Add flag to disable guest CPU metrics #2123
  • [ENHANCEMENT] Add DMI collector #2131
  • [ENHANCEMENT] Add threads metrics to processes collector #2164
  • [ENHANCMMENT] Reduce timer GC delays in the Linux filesystem collector #2169
  • [ENHANCMMENT] Add TCPTimeouts to netstat default filter #2189
  • [ENHANCMMENT] Use SysctlTimeval for boottime collector on BSD #2208
  • [BUGFIX] ethtool: Sanitize metric names #2093
  • [BUGFIX] Fix ethtool collector for multiple interfaces #2126
  • [BUGFIX] Fix possible panic on macOS #2133
  • [BUGFIX] Collect flag_info and bug_info only for one core #2156
  • [BUGFIX] Prevent duplicate ethtool metric names #2187
• Update to 1.2.2
  • Bug fixes Fix processes collector long int parsing #2112
• Update to 1.2.1
  • Removed Remove obsolete capture permission denied error patch already included upstream Fix zoneinfo parsing prometheus/procfs#386 Fix nvme collector log noise #2091 Fix rapl collector log noise #2092
• Update to 1.2.0
  • Changes Rename filesystem collector flags to match other collectors #2012 Make node_exporter print usage to STDOUT #203
  • Features Add conntrack statistics metrics #1155 Add ethtool stats collector #1832 Add flag to ignore network speed if it is unknown #1989 Add tapestats collector for Linux #2044 Add nvme collector #2062
  • Enhancements Add ErrorLog plumbing to promhttp #1887 Add more Infiniband counters #2019 netclass: retrieve interface names and filter before parsing #2033 Add time zone offset metric #2060 Handle errors from disabled PSI subsystem #1983 Fix panic when using backwards compatible flags #2000 Fix wrong value for OpenBSD memory buffer cache #2015 Only initiate collectors once #2048 Handle small backwards jumps in CPU idle #2067
• Capture permission denied error for 'energy_uj' file (bsc#1190535)

patterns-suse-manager:

• Golang-github-wrouesnel-postgres_exporter was renamed to prometheus-postgres_exporter

postgresql-jdbc:

• CVE-2022-26520: Address Arbitrary File Write Vulnerability (bsc#1197356)
• CVE-2022-21724: Address unchecked class instantiation when loading plugins based on class names (bsc#1195561)

prometheus-exporters-formula:

• Version 0.9.5
  • Postgres exporter package was renamed for Red Hat
• Version 0.9.4
  • Postgres exporter package was renamed for SUSE Linux Enterprise Server and openSUSE

prometheus-formula:

• Version 0.3.7
  • Allow prometheus-formula only for SUSE systems (bsc#1199149)

py27-compat-salt:

• Remove redundant overrides causing confusing DEBUG logging…

This update for postgresql-jdbc fixes the following issues:

• CVE-2022-26520: Fixed arbitrary File Write Vulnerability (bsc#1197356)