pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jdbc-postgresql: Unchecked Class Instantiation when providing Plugin Classes (CVE-2022-21724)

  - A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory     and not check the host name if a host name verifier was not provided to the driver. This could lead to a     condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a     certificate for the wrong host, as long as it was signed by a trusted CA. (CVE-2018-10936)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jdbc-postgresql: Unchecked Class Instantiation when providing Plugin Classes (CVE-2022-21724)

  - A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory     and not check the host name if a host name verifier was not provided to the driver. This could lead to a     condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a     certificate for the wrong host, as long as it was signed by a trusted CA. (CVE-2018-10936)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The version of PaperCut NG installed on the remote Windows host is affected by multiple vulnerabilities, as follows:

    - An authentication bypass exists that could allow a remote, unauthenticated attacker to upload arbitrary files to       the PaperCut host’s file storage. This could exhaust system resources and prevent the service from operating as       expected. (CVE-2023-3486)

    - A path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code       execution when external device integration is enabled (a very common configuration). (CVE-2023-39143)

    - A third party library issue in pgjdbc. pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in       the jdbc driver for postgresql database while doing security research. The system using the postgresql library       will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on       class names provided via authenticationPluginClassName, sslhostnameverifier, socketFactory, sslfactory,       sslpasswordcallback connection properties. However, the driver did not verify if the class implements the expected       interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users       using plugins are advised to upgrade. There are no known workarounds for this issue. (CVE-2022-21724)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PaperCut MF installed on the remote Windows host is affected by multiple vulnerabilities, as follows:

    - An authentication bypass exists that could allow a remote, unauthenticated attacker to upload arbitrary files to       the PaperCut host’s file storage. This could exhaust system resources and prevent the service from operating as       expected. (CVE-2023-3486)

    - A path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code       execution when external device integration is enabled (a very common configuration). (CVE-2023-39143)

    - A third party library issue in pgjdbc. pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in       the jdbc driver for postgresql database while doing security research. The system using the postgresql library       will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on       class names provided via authenticationPluginClassName, sslhostnameverifier, socketFactory, sslfactory,       sslpasswordcallback connection properties. However, the driver did not verify if the class implements the expected       interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users       using plugins are advised to upgrade. There are no known workarounds for this issue. (CVE-2022-21724)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5196 advisory.

  - PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. (CVE-2020-13692)

  - pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql     database while doing security research. The system using the postgresql library will be attacked when     attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names     provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`,     `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements     the expected interface before instantiating the class. This can lead to code execution loaded via     arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this     issue. (CVE-2022-21724)

  - ** DISPUTED ** In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call     java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel     connection properties. An example situation is that an attacker could create an executable JSP file under     a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a     vulnerability for any application to use the pgjdbc driver with untrusted connection properties.
    (CVE-2022-26520)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the postgresql-jdbc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql     database while doing security research. The system using the postgresql library will be attacked when     attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names     provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`,     `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements     the expected interface before instantiating the class. This can lead to code execution loaded via     arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this     issue. (CVE-2022-21724)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-3018 advisory.

  - pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql     database while doing security research. The system using the postgresql library will be attacked when     attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names     provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`,     `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements     the expected interface before instantiating the class. This can lead to code execution loaded via     arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this     issue. (CVE-2022-21724)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198938	RHEL 7 : postgresql-jdbc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198936	RHEL 8 : postgresql-jdbc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195993	RHEL 6 : jdbc-postgresql (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
183242	PaperCut NG < 20.1.9 / 21.x < 21.2.13 / 22.x < 22.1.3 Multiple Vulnerabilities	Nessus	Windows	critical
183241	PaperCut MF < 20.1.9 / 21.x < 21.2.13 / 22.x < 22.1.3 Multiple Vulnerabilities	Nessus	Windows	critical
163651	Debian DSA-5196-1 : libpgjava - security update	Nessus	Debian Local Security Checks	critical
162473	EulerOS 2.0 SP8 : postgresql-jdbc (EulerOS-SA-2022-1946)	Nessus	Huawei Local Security Checks	critical
161433	Debian DLA-3018-1 : libpgjava - LTS security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2022-21724

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical