CVE-2022-21724

Deeper analysis

pgjdbc, the official PostgreSQL JDBC Driver, contains an improper instantiation flaw (CWE-665) that allows plugin classes to be loaded from connection properties such as authenticationPluginClassName, sslhostnameverifier, socketFactory, sslfactory, and sslpasswordcallback. The driver performs no interface verification before instantiating the supplied class name, enabling arbitrary code execution when an attacker can influence the JDBC URL or properties. The issue affects applications that rely on the pgjdbc driver and was assigned a CVSS 3.1 score of 7.0.

An attacker with local access who can control the JDBC connection string or associated properties can supply a malicious class name, causing the driver to load and execute attacker-controlled code with the privileges of the connecting application. No authentication or user interaction is required beyond the ability to set the connection properties, though the attack vector is rated local with high complexity.

The GitHub advisory and linked patches recommend upgrading to a fixed version of pgjdbc for users who employ plugins; no workarounds are documented. Downstream distributions including Debian LTS and Fedora have issued updated packages, and NetApp has published an advisory confirming impact on affected storage products.

The EPSS score reached a peak of 0.0541 before receding to its current value of 0.0314, indicating limited but observable post-disclosure interest that has since declined.