Test ID:	1.3.6.1.4.1.25623.1.0.705196
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-5196-1)
Summary:	The remote host is missing an update for the Debian 'libpgjava' package(s) announced via the DSA-5196-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'libpgjava' package(s) announced via the DSA-5196-1 advisory. Vulnerability Insight: Several security vulnerabilities have been found in libpgjava, the official PostgreSQL JDBC Driver. CVE-2020-13692 An XML External Entity (XXE) weakness was found in PostgreSQL JDBC. CVE-2022-21724 The JDBC driver did not verify if certain classes implemented the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. CVE-2022-26520 An attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. For the oldstable distribution (buster), these problems have been fixed in version 42.2.5-2+deb10u1. For the stable distribution (bullseye), these problems have been fixed in version 42.2.15-1+deb11u1. We recommend that you upgrade your libpgjava packages. For the detailed security status of libpgjava please refer to its security tracker page at: [link moved to references] Affected Software/OS: 'libpgjava' package(s) on Debian 10, Debian 11. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2022-21724 https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-v7wg-cpwc-24m4 Debian Security Information: DSA-5196 (Google Search) https://www.debian.org/security/2022/dsa-5196 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BVEO7BEFXPBVHSPYL3YKQWZI6DYXQLFS/ https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813 https://lists.debian.org/debian-lts-announce/2022/05/msg00027.html Common Vulnerability Exposure (CVE) ID: CVE-2022-26520 https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8 https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3 https://jdbc.postgresql.org/documentation/head/tomcat.html
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.