HomeFreeBSD

databases/postgresql-jdbc: update to 42.3.3.

Description

databases/postgresql-jdbc: update to 42.3.3.

A security advisory has been created for the PostgreSQL JDBC Driver. The
URL connection string loggerFile property could be mis-used to create an
arbitrary file on the system that the driver is loaded. Additionally
anything in the connection string will be logged and subsequently
written into that file. In an insecure system it would be possible to
execute this file through a webserver.

While we do not consider this a security issue with the driver, we have
decided to remove the loggerFile and loggerLevel connection properties
in the next release of the driver. Removal of those properties does not
make exposing the JDBC URL or connection properties to an attacker safe
and we continue to suggest that applications do not allow untrusted
users to specify arbitrary connection properties.

We are removing them to prevent misuse and their functionality can be
delegated to java.util.logging. The changelog is not very useful as the
change was done behind a security advisory. The short version is that
loggerFile and loggerLevel properties still exist but do not do
anything.

Security: https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8

Details

Provenance
girgenAuthored on Feb 17 2022, 1:12 PM
Parents
R11:545919720487: net-mgmt/telegraf: update to 1.21.4
Branches
Unknown
Tags
Unknown