Skip to content
Fencer Vulns
medium 4.7

CVE-2022-41946 json

TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc

published 2022-11-23 3 y ago modified 2026-09-08 2 mo ago also BIT-postgresql-jdbc-driver-2022-41946 , EUVD-2022-7235 , GHSA-562r-vg33-8x8h

cvss
4.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `PreparedStatemet.setBytea(int, InputStream)` will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which is readable by other users on Unix like systems, but not MacOS. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. Java 1.7 and higher users: this vulnerability is fixed in 4.5.0. Java 1.6 and lower users: no patch is available. If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will mitigate this vulnerability.

Patch / fix

  • maven org.postgresql:postgresql 42.2.27, 42.3.8, 42.4.3, 42.5.1
  • bitnami postgresql-jdbc-driver 42.2.27, 42.3.8, 42.4.3, 42.5.1
  • postgresql postgresql_jdbc_driver 42.2.27, 42.3.8, 42.4.3
  • libpgjava Debian 14, Debian 13, Debian 12 42.5.1-1

debian advisories DEBIAN-CVE-2022-41946

  • cjson satellite capsule 6.13, satellite 6.13 1.7.14-5.el8sat
  • foreman satellite utils 6.13, satellite capsule 6.13, satellite 6.13 3.5.1.14-1.el8sat
  • katello satellite capsule 6.13, satellite 6.13 4.7.0-1.el8sat
  • libsolv satellite capsule 6.13, satellite 6.13 0.7.22-4.el8pc
  • libcomps satellite capsule 6.13, satellite 6.13 0.1.18-4.el8pc
  • qpid-cpp satellite capsule 6.13, satellite 6.13 1.39.0-7.el8amq
  • qpid-qmf satellite capsule 6.13, satellite 6.13 1.39.0-7.el8amq
  • candlepin satellite 6.13 4.2.13-1.el8sat

red hat advisories RHSA-2023:2097RHSA-2023:2867RHSA-2023:2378RHSA-2023:1630RHSA-2023:0759

  • postgresql-jdbc SLE Real Time 15 SP3, Manager Server Module 4.2 42.2.25-150300.3.11.2
  • postgresql-jdbc SLES for SAP 12 SP5, SLES 12 SP5 9.4-3.9.1
  • postgresql-jdbc SLE Module for Server Applications 15 SP4, openSUSE Leap 15.4 42.2.25-150400.3.9.2

suse advisories SUSE-SU-2023:0451-1SUSE-SU-2023:0104-1SUSE-SU-2023:0103-1

  • postgresql-jdbc AlmaLinux 8 42.2.14-2.el8
  • postgresql-jdbc-javadoc AlmaLinux 8 42.2.14-2.el8
  • postgresql-jdbc AlmaLinux 9 42.2.27-1.el9

almalinux advisories ALSA-2023:2867ALSA-2023:2378

  • java-postgresql-jdbc Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 42.5.1-r0

alpine advisories ALPINE-CVE-2022-41946

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-41946 updated cvss 5.5

postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions

  • Red Hat Enterprise Linux 6 postgresql-jdbc Red Hat Enterprise Linux 7 postgresql-jdbc, postgresql-jdbc-javadoc
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 postgresql-jdbc, postgresql-jdbc-javadoc
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 postgresql-jdbc Red Hat Integration Camel Quarkus 1 jdbc-postgresql jdbc-postgresql
    affected: no fix available
  • Red Hat Process Automation 7 jdbc-postgresql jdbc-postgresql
    affected: no fix planned “Out of support scope”
  • Red Hat Virtualization 4 postgresql-jdbc, postgresql-jdbc-javadoc
    affected: no fix available “Fix deferred”
  • Red Hat CEQ 2.13.2-1
    fixed: vendor fix RHSA-2023:0888
  • Red Hat build of Quarkus
    fixed: vendor fix RHSA-2023:0758
  • Red Hat build of Quarkus 2.7.7
    fixed: vendor fix RHSA-2023:1006
show 9 more
  • Red Hat Enterprise Linux AppStream (v. 8) postgresql-jdbc 42.2.14-2.el8, postgresql-jdbc-javadoc 42.2.14-2.el8
    fixed: vendor fix RHSA-2023:2867
  • Red Hat Enterprise Linux AppStream (v. 9) postgresql-jdbc 42.2.27-1.el9
    fixed: vendor fix RHSA-2023:2378
  • Red Hat Fuse 7.12
    fixed: vendor fix RHSA-2023:3954
  • Red Hat Satellite 6.12 for RHEL 8 candlepin 4.1.20-1.el8sat, candlepin-selinux 4.1.20-1.el8sat
    fixed: vendor fix RHSA-2023:1630
  • Red Hat Satellite 6.13 for RHEL 8 candlepin 4.2.13-1.el8sat, candlepin-selinux 4.2.13-1.el8sat
    fixed: vendor fix RHSA-2023:2097
  • Red Hat RHINT Camel-K-1.10.1
    fixed: vendor fix RHSA-2023:3906
  • Red Hat RHINT Camel-Q 2.7-1
    fixed: vendor fix RHSA-2023:1177
  • Red Hat RHINT Debezium 2.1.4
    fixed: vendor fix RHSA-2023:1815
  • Red Hat build of Apicurio Registry 2 jdbc-postgresql jdbc-postgresql Red Hat Satellite 6.12 for RHEL 8 foreman 3.3.0.21-2.el8sat, satellite 6.12.3-1.el8sat, python-django 3.2.16-1.el8pc, foreman-cli 3.3.0.21-2.el8sat, foreman-ec2 3.3.0.21-2.el8sat, foreman-gce 3.3.0.21-2.el8sat, +23 more Red Hat Satellite 6.13 for RHEL 8 cjson 1.7.14-5.el8sat, katello 4.7.0-1.el8sat, libsolv 0.7.22-4.el8pc, libcomps 0.1.18-4.el8pc, python-idna 3.3-2.el8pc, python-pbr 5.8.0-4.el8pc, +669 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-562r-vg33-8x8h referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.postgresql:postgresql
>=42.2.0, <42.2.27
>=42.3.0, <42.3.8
>=42.4.0, <42.4.3
>=42.5.0, <42.5.1
42.2.27
42.3.8
42.4.3
42.5.1
bitnami postgresql-jdbc-driver
>=42.2.0, <42.2.27
>=42.3.0, <42.3.8
>=42.4.0, <42.4.3
>=42.5.0, <42.5.1
42.2.27
42.3.8
42.4.3
42.5.1

Affected products

  • pgjdbc pgjdbc

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-377 DEPRECATED: Insecure Temporary File
  • CWE-668 Exposure of Resource to Wrong Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.