Postgres Pro
Downloads
Home   >   mailing lists

PostgreSQL JDBC 42.3.3 Released - Mailing list pgsql-announce

From JDBC Project via PostgreSQL Announce
Subject PostgreSQL JDBC 42.3.3 Released
Date
Msg-id 164509828721.681.3705749846813252999@wrigleys.postgresql.org
Whole thread Raw
List pgsql-announce
Tree view
 

PostgreSQL JDBC 42.3.3 Released

A security advisory has been created for the PostgreSQL JDBC Driver. The URL connection string loggerFile property could be mis-used to create an arbitrary file on the system that the driver is loaded. Additionally anything in the connection string will be logged and subsequently written into that file. In an insecure system it would be possible to execute this file through a webserver.

While we do not consider this a security issue with the driver, we have decided to remove the loggerFile and loggerLevel connection properties in the next release of the driver. Removal of those properties does not make exposing the JDBC URL or connection properties to an attacker safe and we continue to suggest that applications do not allow untrusted users to specify arbitrary connection properties.

We are removing them to prevent misuse and their functionality can be delegated to java.util.logging. The changelog is not very useful as the change was done behind a security advisory. The short version is that loggerFile and loggerLevel properties still exist but do not do anything.

The PostgreSQL JDBC team would like to thank all that have participated in this release!

The JDBC Team

This email was sent to you from JDBC Project. It was delivered on their behalf by the PostgreSQL project. Any questions about the content of the message should be sent to JDBC Project.

You were sent this email as a subscriber of the pgsql-announce mailinglist, for for one of the content tags Related Open Source or Security. To unsubscribe from further emails, or change which emails you want to receive, please click the personal unsubscribe link that you can find in the headers of this email, or visit https://lists.postgresql.org/unsubscribe/.
 

pgsql-announce by date:

Previous
From: PostgreSQL Code of Conduct Committee via PostgreSQL Announce
Date:
Subject: PostgreSQL Community Code of Conduct Committee Annual Report for 2021
Next
From: Pgpool Global Development Group via PostgreSQL Announce
Date:
Subject: Pgpool-II 4.3.1, 4.2.8, 4.1.11, 4.0.18 and 3.7.23 released.