{"id":"CVE-2022-26520","aliases":["BIT-postgresql-jdbc-driver-2022-26520","CLSA-2025-1754870603","DEBIAN-CVE-2022-26520","DSA-5196-1","EUVD-2022-1351","GHSA-673j-qm5f-xpv8","GHSA-727h-hrw8-jg8q","SUSE-FU-2022:2794-1","SUSE-SU-2022:2143-1","SUSE-SU-2022:2145-1","SUSE-SU-2022:2655-1","UBUNTU-CVE-2022-26520","openSUSE-SU-2024:12126-1"],"status":"disputed","title":"pgjdbc Arbitrary File Write Vulnerability","description":"In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02999,"percentile":0.87457,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-02-16T00:08:18Z","modified":"2026-11-03T08:01:06Z","fixes":[{"ecosystem":"Maven","package":"org.postgresql:postgresql","fixed_in":["42.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"postgresql-jdbc-driver","fixed_in":["42.1.5","42.3.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libpgjava","fixed_in":["42.3.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libpgjava","fixed_in":["42.3.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpgjava","fixed_in":["42.3.3-1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"ongres-scram","fixed_in":["2.1-150300.3.3.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"ongres-stringprep","fixed_in":["1.1-150300.7.3.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"postgresql-jdbc","fixed_in":["42.2.25-150300.3.5.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"ongres-scram","fixed_in":["2.1-150300.3.3.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"ongres-stringprep","fixed_in":["1.1-150300.7.3.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"postgresql-jdbc","fixed_in":["42.2.25-150300.3.5.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"ongres-scram","fixed_in":["2.1-150300.3.3.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"ongres-stringprep","fixed_in":["1.1-150300.7.3.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"postgresql-jdbc","fixed_in":["42.2.25-150300.3.5.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"postgresql-jdbc","fixed_in":["42.2.25-150400.3.3.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"postgresql-jdbc","fixed_in":["42.2.25-150400.3.3.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.1.0"},{"fixed":"42.3.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.1.0"},{"fixed":"42.3.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"postgresql-jdbc-driver","ranges":[{"type":"SEMVER","events":[{"introduced":"42.1.0"},{"fixed":"42.1.5"},{"introduced":"42.3.0"},{"fixed":"42.3.3"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.2.16"},{"fixed":"42.2.16-tuxcare.1"}]}],"versions":["42.2.16"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.3.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.3.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.3.3-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.5-2+deb10u1"}]}],"versions":["42.2.5-2"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.15-1+deb11u1"}]}],"versions":["42.2.15-1"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.1.0"},{"fixed":"42.3.3"}]}],"versions":["42.1.0","42.1.0.jre7","42.1.1","42.1.1.jre6","42.1.1.jre7","42.1.2","42.1.2.jre6","42.1.2.jre7","42.1.3","42.1.3.jre6","42.1.3.jre7","42.1.4","42.1.4.jre6","42.1.4.jre7","42.2.0","42.2.0.jre6","42.2.0.jre7","42.2.1","42.2.1.jre6","42.2.1.jre7","42.2.10","42.2.10.jre6","42.2.10.jre7","42.2.11","42.2.11.jre6","42.2.11.jre7","42.2.12","42.2.12.jre6","42.2.12.jre7","42.2.13","42.2.13.jre6","42.2.13.jre7","42.2.14","42.2.14.jre6","42.2.14.jre7","42.2.15","42.2.15.jre6","42.2.15.jre7","42.2.16","42.2.16.jre6","42.2.16.jre7","42.2.17","42.2.17.jre6","42.2.17.jre7","42.2.18","42.2.18.jre6","42.2.18.jre7","42.2.19","42.2.19.jre6","42.2.19.jre7","42.2.2","42.2.2.jre6","42.2.2.jre7","42.2.20","42.2.20.jre6","42.2.20.jre7","42.2.21","42.2.21.jre6","42.2.21.jre7","42.2.22","42.2.22.jre6","42.2.22.jre7","42.2.23","42.2.23.jre6","42.2.23.jre7","42.2.24","42.2.24.jre6","42.2.24.jre7","42.2.25","42.2.25.jre6","42.2.25.jre7","42.2.26","42.2.26.jre6","42.2.26.jre7","42.2.27","42.2.27.jre6","42.2.27.jre7","42.2.28","42.2.28.jre7","42.2.29","42.2.3","42.2.3.jre6","42.2.3.jre7","42.2.4","42.2.4.jre6","42.2.4.jre7","42.2.5","42.2.5.jre6","42.2.5.jre7","42.2.6","42.2.6.jre6","42.2.6.jre7","42.2.7","42.2.7.jre6","42.2.7.jre7","42.2.8","42.2.8.jre6","42.2.8.jre7","42.2.9","42.2.9.jre6","42.2.9.jre7","42.3.0","42.3.1","42.3.2"]},{"source":"osv","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"42.1.0"},{"fixed":"42.3.3"}]}],"versions":["42.1.0","42.1.0.jre7","42.1.1","42.1.1.jre6","42.1.1.jre7","42.1.2","42.1.2.jre6","42.1.2.jre7","42.1.3","42.1.3.jre6","42.1.3.jre7","42.1.4","42.1.4.jre6","42.1.4.jre7","42.2.0","42.2.0.jre6","42.2.0.jre7","42.2.1","42.2.1.jre6","42.2.1.jre7","42.2.10","42.2.10.jre6","42.2.10.jre7","42.2.11","42.2.11.jre6","42.2.11.jre7","42.2.12","42.2.12.jre6","42.2.12.jre7","42.2.13","42.2.13.jre6","42.2.13.jre7","42.2.14","42.2.14.jre6","42.2.14.jre7","42.2.15","42.2.15.jre6","42.2.15.jre7","42.2.16","42.2.16.jre6","42.2.16.jre7","42.2.17","42.2.17.jre6","42.2.17.jre7","42.2.18","42.2.18.jre6","42.2.18.jre7","42.2.19","42.2.19.jre6","42.2.19.jre7","42.2.2","42.2.2.jre6","42.2.2.jre7","42.2.20","42.2.20.jre6","42.2.20.jre7","42.2.21","42.2.21.jre6","42.2.21.jre7","42.2.22","42.2.22.jre6","42.2.22.jre7","42.2.23","42.2.23.jre6","42.2.23.jre7","42.2.24","42.2.24.jre6","42.2.24.jre7","42.2.25","42.2.25.jre6","42.2.25.jre7","42.2.26","42.2.26.jre6","42.2.26.jre7","42.2.27","42.2.27.jre6","42.2.27.jre7","42.2.28","42.2.28.jre7","42.2.29","42.2.3","42.2.3.jre6","42.2.3.jre7","42.2.4","42.2.4.jre6","42.2.4.jre7","42.2.5","42.2.5.jre6","42.2.5.jre7","42.2.6","42.2.6.jre6","42.2.6.jre7","42.2.7","42.2.7.jre6","42.2.7.jre7","42.2.8","42.2.8.jre6","42.2.8.jre7","42.2.9","42.2.9.jre6","42.2.9.jre7","42.3.0","42.3.1","42.3.2"]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"ongres-scram","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-150300.3.3.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"ongres-stringprep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1-150300.7.3.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150300.3.5.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"ongres-scram","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-150300.3.3.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"ongres-stringprep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1-150300.7.3.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150300.3.5.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"ongres-scram","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-150300.3.3.4"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"ongres-stringprep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1-150300.7.3.4"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150300.3.5.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.15-150200.3.56.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.15-150200.3.56.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.15-150200.3.80.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150200.6.12.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-150200.2.6.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-150200.3.9.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-150200.6.12.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.10-150200.3.8.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-150200.3.31.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.7-150200.3.21.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"py27-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000.3-150200.6.24.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.18-150200.4.39.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.31-150200.4.50.4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.46-150200.3.71.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.11-150200.3.18.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.20-150200.3.30.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.34-150200.3.47.6"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28-150200.3.15.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.36-150200.3.52.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-150200.11.55.4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-150200.11.55.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.26-150200.3.45.4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.36-150200.3.64.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150400.3.3.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-150400.3.3.2"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"postgresql","product":"postgresql_jdbc_driver"}],"references":[{"url":"https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","web"]},{"url":"https://jdbc.postgresql.org/documentation/head/tomcat.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2022/dsa-5196","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/pgjdbc/pgjdbc/commit/f6d47034a4ce292e1a659fa00963f6f713117064","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-673j-qm5f-xpv8"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26520","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-727h-hrw8-jg8q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26520.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-26520","tags":["advisory"]},{"url":"https://github.com/pgjdbc/pgjdbc","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/-2022-2794/suse-fu-20222794-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1196693","tags":["report"]},{"url":"https://bugzilla.suse.com/1197356","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-26520","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222143-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182742","tags":["report"]},{"url":"https://bugzilla.suse.com/1189501","tags":["report"]},{"url":"https://bugzilla.suse.com/1190535","tags":["report"]},{"url":"https://bugzilla.suse.com/1192850","tags":["report"]},{"url":"https://bugzilla.suse.com/1193032","tags":["report"]},{"url":"https://bugzilla.suse.com/1193238","tags":["report"]},{"url":"https://bugzilla.suse.com/1193707","tags":["report"]},{"url":"https://bugzilla.suse.com/1194262","tags":["report"]},{"url":"https://bugzilla.suse.com/1194447","tags":["report"]},{"url":"https://bugzilla.suse.com/1194594","tags":["report"]},{"url":"https://bugzilla.suse.com/1194909","tags":["report"]},{"url":"https://bugzilla.suse.com/1195561","tags":["report"]},{"url":"https://bugzilla.suse.com/1196338","tags":["report"]},{"url":"https://bugzilla.suse.com/1196407","tags":["report"]},{"url":"https://bugzilla.suse.com/1196702","tags":["report"]},{"url":"https://bugzilla.suse.com/1196704","tags":["report"]},{"url":"https://bugzilla.suse.com/1197429","tags":["report"]},{"url":"https://bugzilla.suse.com/1197438","tags":["report"]},{"url":"https://bugzilla.suse.com/1197488","tags":["report"]},{"url":"https://bugzilla.suse.com/1198221","tags":["report"]},{"url":"https://bugzilla.suse.com/1198356","tags":["report"]},{"url":"https://bugzilla.suse.com/1198686","tags":["report"]},{"url":"https://bugzilla.suse.com/1198914","tags":["report"]},{"url":"https://bugzilla.suse.com/1199036","tags":["report"]},{"url":"https://bugzilla.suse.com/1199142","tags":["report"]},{"url":"https://bugzilla.suse.com/1199149","tags":["report"]},{"url":"https://bugzilla.suse.com/1199512","tags":["report"]},{"url":"https://bugzilla.suse.com/1199528","tags":["report"]},{"url":"https://bugzilla.suse.com/1199629","tags":["report"]},{"url":"https://bugzilla.suse.com/1199677","tags":["report"]},{"url":"https://bugzilla.suse.com/1199888","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31248","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222145-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173527","tags":["report"]},{"url":"https://bugzilla.suse.com/1191143","tags":["report"]},{"url":"https://bugzilla.suse.com/1196067","tags":["report"]},{"url":"https://bugzilla.suse.com/1199577","tags":["report"]},{"url":"https://bugzilla.suse.com/1200212","tags":["report"]},{"url":"https://bugzilla.suse.com/1200606","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21698","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222655-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-26520","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26520","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-26520","description":"In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties","status":"disputed","published":"2022-03-07T17:00:37Z","modified":"2024-08-03T05:03:32.964Z","updated_at":"2026-11-02T14:34:26.293612Z"}],"euvd":[{"id":"EUVD-2022-1351","description":"In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties","status":"published","published":"2022-03-07T17:00:37Z","modified":"2024-08-03T05:03:32Z","updated_at":"2026-11-03T03:25:45.346573Z"}],"ghsa":[{"id":"GHSA-673j-qm5f-xpv8","title":"pgjdbc Arbitrary File Write Vulnerability","description":"### Overview\nThe connection properties for configuring a pgjdbc connection are not meant to be exposed to an unauthenticated attacker. While allowing an attacker to specify arbitrary connection properties could lead to a compromise of a system, that's a defect of an application that allows unauthenticated attackers that level of control.\n\nIt's not the job of the pgjdbc driver to decide whether a given log file location is acceptable. End user applications that use the pgjdbc driver must ensure that filenames are valid and restrict unauthenticated attackers from being able to supply arbitrary values. That's not specific to the pgjdbc driver either, it would be true for any library that can write to the application's local file system.\n\nWhile we do not consider this a security issue with the driver, we have decided to remove the loggerFile and loggerLevel connection properties in the next release of the driver. Removal of those properties does not make exposing the JDBC URL or connection properties to an attacker safe and we continue to suggest that applications do not allow untrusted users to specify arbitrary connection properties. We are removing them to prevent misuse and their functionality can be delegated to java.util.logging.\n\nIf you identify an application that allows remote users to specify a complete JDBC URL or properties without validating it's contents, we encourage you to notify the application owner as that may be a security defect in that specific application.\n\n### Impact\nIt is possible to specify an arbitrary filename in the loggerFileName connection parameter\n\"jdbc:postgresql://localhost:5432/test?user=test\u0026password=test\u0026loggerLevel=DEBUG\u0026loggerFile=./blah.jsp\u0026\u003c%Runtime.getRuntime().exec(request.getParameter(\\\"i\\\"));%\u003e\"\n\nThis creates a valid JSP file which could lead to a Remote Code Execution \n\n### Patches\nLoggerFile implementation has been removed and will be ignored by the driver, fixed in 42.3.3\n\n### Workarounds\nsanitize the inputs to the driver\n\nReported by Allan Lou v3ged0ge@gmail.com","status":"published","published":"2022-02-16T00:08:18Z","modified":"2024-01-22T19:35:00Z","updated_at":"2026-11-02T14:37:31.550603Z"},{"id":"GHSA-727h-hrw8-jg8q","title":"Path traversal in org.postgresql:postgresql","description":"In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties.","status":"published","published":"2022-03-11T00:02:02Z","modified":"2023-08-03T17:41:55Z","updated_at":"2026-11-02T14:36:58.760727Z"}],"nvd":[{"id":"CVE-2022-26520","description":"In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties","status":"disputed","published":"2022-03-10T17:47:45.81Z","modified":"2026-06-17T04:35:20.7Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:07:13.7085Z"}],"osv":[{"id":"DEBIAN-CVE-2022-26520","description":"In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties","status":"published","published":"2022-03-10T17:47:45.81Z","modified":"2026-11-03T08:01:06.942970791Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"UBUNTU-CVE-2022-26520","description":"** DISPUTED ** In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties.","status":"withdrawn","published":"2022-03-10T17:47:00Z","modified":"2025-07-16T07:44:22.206982Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"BIT-postgresql-jdbc-driver-2022-26520","description":"In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties","status":"published","published":"2024-03-06T11:02:21.105Z","modified":"2026-09-08T08:47:05.736250409Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"CLSA-2025-1754870603","title":"TuxCare security update for org.postgresql:postgresql (3 CVEs)","description":"TuxCare rebuilt org.postgresql:postgresql to address 3 CVEs. Fixed in 42.2.16-tuxcare.1.","status":"published","published":"2026-08-04T14:52:04Z","modified":"2026-10-15T09:45:03.055656016Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CVE-2022-26520","description":"In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties","status":"published","published":"2022-03-07T17:00:37Z","modified":"2026-10-28T02:30:49.613415628Z","updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"DSA-5196-1","title":"libpgjava - security update","status":"published","published":"2022-07-31T00:00:00Z","modified":"2026-03-09T02:09:10.103269Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"GHSA-673j-qm5f-xpv8","title":"pgjdbc Arbitrary File Write Vulnerability","description":"### Overview\nThe connection properties for configuring a pgjdbc connection are not meant to be exposed to an unauthenticated attacker. While allowing an attacker to specify arbitrary connection properties could lead to a compromise of a system, that's a defect of an application that allows unauthenticated attackers that level of control.\n\nIt's not the job of the pgjdbc driver to decide whether a given log file location is acceptable. End user applications that use the pgjdbc driver must ensure that filenames are valid and restrict unauthenticated attackers from being able to supply arbitrary values. That's not specific to the pgjdbc driver either, it would be true for any library that can write to the application's local file system.\n\nWhile we do not consider this a security issue with the driver, we have decided to remove the loggerFile and loggerLevel connection properties in the next release of the driver. Removal of those properties does not make exposing the JDBC URL or connection properties to an attacker safe and we continue to suggest that applications do not allow untrusted users to specify arbitrary connection properties. We are removing them to prevent misuse and their functionality can be delegated to java.util.logging.\n\nIf you identify an application that allows remote users to specify a complete JDBC URL or properties without validating it's contents, we encourage you to notify the application owner as that may be a security defect in that specific application.\n\n### Impact\nIt is possible to specify an arbitrary filename in the loggerFileName connection parameter\n\"jdbc:postgresql://localhost:5432/test?user=test\u0026password=test\u0026loggerLevel=DEBUG\u0026loggerFile=./blah.jsp\u0026\u003c%Runtime.getRuntime().exec(request.getParameter(\\\"i\\\"));%\u003e\"\n\nThis creates a valid JSP file which could lead to a Remote Code Execution \n\n### Patches\nLoggerFile implementation has been removed and will be ignored by the driver, fixed in 42.3.3\n\n### Workarounds\nsanitize the inputs to the driver\n\nReported by Allan Lou v3ged0ge@gmail.com","status":"published","published":"2022-02-16T00:08:18Z","modified":"2026-09-10T03:49:16.897291449Z","updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"GHSA-727h-hrw8-jg8q","title":"Path traversal in org.postgresql:postgresql","description":"In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties.","status":"published","published":"2022-03-11T00:02:02Z","modified":"2026-09-10T03:49:13.124569915Z","updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"openSUSE-SU-2024:12126-1","title":"postgresql-jdbc-42.2.25-2.1 on GA media","description":"These are all security issues fixed in the postgresql-jdbc-42.2.25-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:41:46.084167Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-FU-2022:2794-1","title":"Feature update for ongres-scram, ongres-stringprep, postgresql-jdbc","description":"This feature update for ongres-scram, ongres-stringprep, postgresql-jdbc provides:\n\n    \nongres-scram:\n\n- Upgrade from version 1.0.0-beta.2 to version 2.1. (jsc#SLE-23994)\n  * Add standard `SASLPrep` (bsc#1196693, jsc#SLE-23994)\n  * Failover to bouncy castle implementation of `PBKDF2WithHmacSHA256` to support Oracle JDK 7\n  * Updated `saslprep` to version 1.1 to remove a build dependency coming from the `stringprep` module\n\nongres-stringprep:\n\n- Introduce `ongres-stringprep` 1.1 as dependency of `ongres-scram`. (bsc#1196693, jsc#SLE-23994)\n\npostgresql-jdbc: \n\n- CVE-2022-26520: Fixed arbitrary File Write Vulnerability (bsc#1197356)\n- Upgrade postgresql-jdbc from version 42.2.16 to version 42.2.25 (jsc#SLE-23994)\n  * Use `SASLprep` normalization for SCRAM authentication and fixes issues with spaces in passwords. (bsc#1196693)\n","status":"published","published":"2022-08-12T09:14:03Z","modified":"2026-02-04T04:01:47.932615Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2022:2143-1","title":"Recommended update for SUSE Manager 4.1.15 Release Notes","description":"This update for SUSE Manager 4.1.15 Release Notes provides the following additions:\n\nRelease notes for SUSE Manager:\n\n- Update to 4.1.15\n  * Salt has been upgraded to 3004 version\n  * Grafana has been upgraded to 8.3.5\n  * Postgres exporter has been upgraded to 0.10.0\n  * Alertmanager has been upgraded to 0.23.0\n  * Node exporter has been upgraded 1.3.0\n  * CVEs fixed: CVE-2022-21724, CVE-2022-21952, CVE-2022-31248, CVE-2022-26520\n  * Bugs mentioned:\n    bsc#1182742, bsc#1189501, bsc#1190535, bsc#1192850, bsc#1193032\n    bsc#1193238, bsc#1193707, bsc#1194262, bsc#1194447, bsc#1194594\n    bsc#1194909, bsc#1195561, bsc#1196338, bsc#1196407, bsc#1196702\n    bsc#1196704, bsc#1197356, bsc#1197429, bsc#1197438, bsc#1197488\n    bsc#1198221, bsc#1198356, bsc#1198686, bsc#1198914, bsc#1199036\n    bsc#1199142, bsc#1199149, bsc#1199512, bsc#1199528, bsc#1199629\n    bsc#1199677, bsc#1199888\n\nRelease notes for SUSE Manager proxy:\n\n- Update to 4.1.15\n  * Salt has been upgraded to 3004 version\n  * Bugs mentioned:\n    bsc#1190535, bsc#1193238, bsc#1194447, bsc#1194594, bsc#1194909\n    bsc#1196338, bsc#1196704, bsc#1199142, bsc#1199528\n","status":"published","published":"2022-06-20T14:10:44Z","modified":"2026-02-04T03:03:40.133294Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2145-1","title":"Security update for SUSE Manager Server 4.1","description":"This update fixes the following issues:\n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Adapted to build on Enterprise Linux.\n- Fix build for RedHat 7\n- Require Go \u003e= 1.14 also for CentOS\n- Add support for CentOS\n- Replace %{?systemd_requires} with %{?systemd_ordering}\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Require building with Go 1.15\n- Add %license macro for LICENSE file \n\ngolang-github-prometheus-node_exporter:\n\n- CVE-2022-21698: Update vendor tarball with prometheus/client_golang 1.11.1\n  (bsc#1196338, jsc#SLE-24238, jsc#SLE-24239)\n- Update to 1.3.0\n  * [CHANGE] Add path label to rapl collector #2146\n  * [CHANGE] Exclude filesystems under /run/credentials #2157\n  * [CHANGE] Add TCPTimeouts to netstat default filter #2189\n  * [FEATURE] Add lnstat collector for metrics from /proc/net/stat/ #1771\n  * [FEATURE] Add darwin powersupply collector #1777\n  * [FEATURE] Add support for monitoring GPUs on Linux #1998\n  * [FEATURE] Add Darwin thermal collector #2032\n  * [FEATURE] Add os release collector #2094\n  * [FEATURE] Add netdev.address-info collector #2105\n  * [FEATURE] Add clocksource metrics to time collector #2197\n  * [ENHANCEMENT] Support glob textfile collector directories #1985\n  * [ENHANCEMENT] ethtool: Expose node_ethtool_info metric #2080\n  * [ENHANCEMENT] Use include/exclude flags for ethtool filtering #2165\n  * [ENHANCEMENT] Add flag to disable guest CPU metrics #2123\n  * [ENHANCEMENT] Add DMI collector #2131\n  * [ENHANCEMENT] Add threads metrics to processes collector #2164\n  * [ENHANCMMENT] Reduce timer GC delays in the Linux filesystem collector #2169\n  * [ENHANCMMENT] Add TCPTimeouts to netstat default filter #2189\n  * [ENHANCMMENT] Use SysctlTimeval for boottime collector on BSD #2208\n  * [BUGFIX] ethtool: Sanitize metric names #2093\n  * [BUGFIX] Fix ethtool collector for multiple interfaces #2126\n  * [BUGFIX] Fix possible panic on macOS #2133\n  * [BUGFIX] Collect flag_info and bug_info only for one core #2156\n  * [BUGFIX] Prevent duplicate ethtool metric names #2187\n- Update to 1.2.2\n  * Bug fixes\n     Fix processes collector long int parsing #2112\n- Update to 1.2.1\n  * Removed\n     Remove obsolete capture permission denied error patch already included upstream\n     Fix zoneinfo parsing prometheus/procfs#386\n     Fix nvme collector log noise #2091\n     Fix rapl collector log noise #2092\n- Update to 1.2.0\n  * Changes\n     Rename filesystem collector flags to match other collectors #2012\n     Make node_exporter print usage to STDOUT #203\n  * Features\n     Add conntrack statistics metrics #1155\n     Add ethtool stats collector #1832\n     Add flag to ignore network speed if it is unknown #1989\n     Add tapestats collector for Linux #2044\n     Add nvme collector #2062\n  * Enhancements\n     Add ErrorLog plumbing to promhttp #1887\n     Add more Infiniband counters #2019\n     netclass: retrieve interface names and filter before parsing #2033\n     Add time zone offset metric #2060\n     Handle errors from disabled PSI subsystem #1983\n     Fix panic when using backwards compatible flags #2000\n     Fix wrong value for OpenBSD memory buffer cache #2015\n     Only initiate collectors once #2048\n     Handle small backwards jumps in CPU idle #2067\n- Capture permission denied error for 'energy_uj' file (bsc#1190535)\n\npatterns-suse-manager:\n\n- Golang-github-wrouesnel-postgres_exporter was renamed to prometheus-postgres_exporter\n\npostgresql-jdbc:\n\n- CVE-2022-26520: Address Arbitrary File Write Vulnerability (bsc#1197356)\n- CVE-2022-21724: Address unchecked class instantiation when loading plugins based on class names (bsc#1195561)\n\nprometheus-exporters-formula:\n\n- Version 0.9.5\n  * Postgres exporter package was renamed for Red Hat\n- Version 0.9.4\n  * Postgres exporter package was renamed for SUSE Linux Enterprise Server and openSUSE\n\nprometheus-formula:\n\n- Version 0.3.7\n  * Allow prometheus-formula only for SUSE systems (bsc#1199149)\n\npy27-compat-salt:\n\n- Remove redundant overrides causing confusing DEBUG logging (bsc#1189501)\n\nspacecmd:\n\n- Version 4.1.18-1\n  * implement system.bootstrap (bsc#1194909)\n\nspacewalk-backend:\n\n- Version 4.1.31-1\n  * Fix traceback on calling spacewalk-repo-sync --show-packages (bsc#1193238)\n  * Fix virt_notify SQL syntax error (bsc#1199528)\n  * Do not raise error on file:// based DEB repo when looking\n    for alternative Release files (bsc#1199142)\n  * Improve parsing deb packages dependencies (bsc#1194594)\n  * Fix reposync update notice formatting and date parsing (bsc#1194447)\n  * implement more decompression algorithms for reposync (bsc#1196704)\n\nspacewalk-java:\n\n- Version 4.1.46-1\n  * Fix changelog to include the reference to CVE-2022-31248\n- Version 4.1.45-1\n  * CVE-2022-31248: User enumeration via weak error message (bsc#1199629)\n  * CVE-2022-21952: Unauthenticated remote Denial of Service via resource exhaustion. (bsc#1199512)\n  * During re-activation, recalculate grains if contact method has been changed (bsc#1199677)\n  * autoinstallation: missing whitespace after install URL (bsc#1199888)\n  * Change system details lock tab name to lock/unlock (bsc#1193032)\n  * Set profile tag has no-mandatory in XCCDF result (bsc#1194262)\n  * Added a notification to inform the administrators about the product end-of-life\n  * provisioning thought proxy should use proxy for self_update (bsc#1199036)\n  * Allow removing duplicated packages names in the same Salt action (bsc#1198686)\n  * Fix ACL rules for config diff download for SLS files (bsc#1198914)\n  * fix invalid link to action schedule\n  * Redesign the auto errata task to schedule combined actions (bsc#1197429)\n  * detect free products in Alpha and Beta stage and prevent checks on openSUSE products (bsc#1197488)\n  * Optimize adding new products function (bsc#1193707)\n  * change directory owner and permissions only when needed\n  * Fixed broken help link for system overview\n  * Finding empty profiles by mac address must be case insensitive (bsc#1196407)\n  * generate the system ssh key when bootstrapping a salt-ssh client (bsc#1194909)\n\nspacewalk-setup:\n\n- Version 4.1.11-1\n  * spacewalk-setup-cobbler assumes /etc/apache2/conf.d now as a\n    default instead of /etc/httpd/conf.d (bsc#1198356)\n\nspacewalk-utils:\n\n- Version 4.1.20-1\n  * spacewalk-hostname-rename now correctly replaces the hostname for\n    the mgr-sync configuration file (bsc#1198356)\n  * spacewalk-hostname-rename now utilizes the '--apache2-conf-dir'\n    flag for spacewalk-setup-cobbler (bsc#1198356)\n\nspacewalk-web:\n\n- Version 4.1.34-1\n  * Update Web UI version to 4.1.15\n- Version 4.1.33-1\n  * Added support for end of life notifications\n\nsubscription-matcher:\n\n- Version 0.28\n  * Support both antlr3-java and antlr3-runtime as dependencies\n  * Make it obvious that log4j12 is used\n\nsusemanager:\n\n- version 4.1.36-1\n  * Add python3-contextvars and python3-immutables to missing bootstrap repos (bsc#1200606)\n- version 4.1.35-1\n  * Add python3-gnupg to bootstrap repo definition for Ubuntu 20.04 (bsc#1200212)\n- Version 4.1.34-1\n  * mgr-sync: Raise a proper exception when duplicated lines exist in a config file (bsc#1182742)\n  * fix SLE15 bootstrap repo definition (bsc#1197438)\n  * Add SLES15SP4 and SUMA Proxy 4.3 to bootstrap\n    repo definitions (bsc#1196702)\n  * Add missing dependencies for Salt 3004 into bootstrap repository\n    for SLE15 family (bsc#1198221)\n\nsusemanager-doc-indexes:\n\n- The Large deployments Guide now includes a mention of the proxy (bsc#1199577)\n- In the Administration Guide, documented that monitoring tools are \n  now available on SUSE Linux Enterprise 12, 15 and openSUSE Leap 15, \n  however, Grafana is not available on Proxy (bsc#1191143)\n- In the Administration Guide, renamed the \n  golang-github-wrouesnel-postgres_exporter to prometheus-postgres_exporter\n- In the Client Configuration and Retail Guides clarified that mandatory \n  channels are automatically checked (bsc#1173527)\n- In the Client Configuration Guide, marked Yomi as unsupported on \n  SUSE Linux Enterprise Server 11 and 12\n- Clarified channel label name in Registering Clients with RHUI \n  section of the Client Configuration Guide (bsc#1196067)\n\nsusemanager-docs_en:\n\n- The Large deployments Guide now includes a mention of the proxy \n  (bsc#1199577)\n- In the Administration Guide, documented that monitoring tools are \n  now available on SUSE Linux Enterprise 12, 15 and openSUSE Leap 15,\n  however, Grafana is not available on Proxy (bsc#1191143)\n- In the Administration Guide, renamed the \n  golang-github-wrouesnel-postgres_exporter to prometheus-postgres_exporter\n- In the Client Configuration and Retail Guides clarified that mandatory \n  channels are automatically checked (bsc#1173527)\n- In the Client Configuration Guide, marked Yomi as unsupported on \n  SUSE Linux Enterprise Server 11 and 12\n- Clarified channel label name in Registering Clients with RHUI \n  section of the Client Configuration Guide (bsc#1196067)\n\nsusemanager-schema:\n\n- Version 4.1.26-1\n  * add schema update directory from 4.1.25 to 4.1.26\n\nsusemanager-sls:\n\n- version 4.1.36-1\n  * Prevent possible tracebacks on calling module.run from mgrcompat by setting proper globals with using LazyLoader\n\n- Version 4.1.35-1\n  * Add support to packages.pkgremove to deal with duplicated pkg names (bsc#1198686)\n  * Fix bootstrap repository path resolution for Oracle Linux\n  * Fix deprecated warning when getting pillar data (bsc#1192850)\n  * fixing how the return code is returned in mgrutil runner (bsc#1194909)\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2022-06-20T14:12:59Z","modified":"2026-02-04T03:40:29.79401Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2655-1","title":"Security update for postgresql-jdbc","description":"This update for postgresql-jdbc fixes the following issues:\n\n- CVE-2022-26520: Fixed arbitrary File Write Vulnerability (bsc#1197356)\n","status":"published","published":"2022-08-03T13:48:03Z","modified":"2026-02-04T03:55:20.268653Z","updated_at":"2026-11-02T15:53:50.965375Z"}]}}