CVE-2022-41946 in pgjdbc
Summary
by MITRE • 11/23/2022
pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `PreparedStatemet.setBytea(int, InputStream)` will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which is readable by other users on Unix like systems, but not MacOS. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. Java 1.7 and higher users: this vulnerability is fixed in 4.5.0. Java 1.6 and lower users: no patch is available. If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will mitigate this vulnerability.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2025
The pgjdbc vulnerability CVE-2022-41946 represents a significant information disclosure issue within the PostgreSQL JDBC driver that affects Unix-like operating systems. This vulnerability stems from how the driver handles large InputStream objects when executing prepared statements, specifically through the setText and setBytea methods. The flaw occurs because the driver creates temporary files in the system's default temporary directory when InputStream data exceeds 2 kilobytes in size, creating a security risk that aligns with CWE-377 - Insecure Temporary File and CWE-200 - Exposure of Sensitive Information.
The technical implementation of this vulnerability involves the JDBC driver's handling of binary and text data streams through prepared statements. When developers use PreparedStatement.setText or PreparedStatement.setBytea methods with InputStream parameters larger than 2KB, the driver automatically generates temporary files in the system's designated temporary directory. This behavior is particularly problematic on Unix-like systems where the temporary directory is shared among all users, making these temporary files accessible to other system users. The vulnerability is classified as a privilege escalation vector through information disclosure rather than direct data manipulation, as the affected files are not writable by other users but are readable, creating a data exposure scenario that violates the principle of least privilege.
The operational impact of this vulnerability extends beyond simple data exposure, as it creates potential for sensitive information leakage in multi-user environments where attackers could access temporary files created by legitimate database operations. The vulnerability's scope is limited to Unix-like systems due to platform-specific file permission handling, with macOS systems being immune due to their different temporary file handling mechanisms. This distinction places the vulnerability in the ATT&CK framework under T1005 - Data from Local System and T1041 - Exfiltration Over C2 Channel, though the latter is more accurately described as indirect information disclosure rather than active data exfiltration.
The fix for this vulnerability requires JDK version compatibility considerations that align with the software development lifecycle and security patch management protocols. Version 4.5.0 of pgjdbc addresses this issue for users operating on Java 1.7 and higher platforms, demonstrating the importance of maintaining current Java runtime environments for security. For legacy systems using Java 1.6 or lower, no direct patch exists, requiring administrators to implement workarounds through system configuration. The mitigation strategy of setting the java.io.tmpdir system property to user-exclusive directories represents a defensive programming approach that aligns with security best practices for legacy system management and demonstrates the principle of defense in depth.
This vulnerability highlights the critical importance of temporary file management in database driver implementations and underscores the need for security considerations in open source software development. The dependency on JDK version requirements for the fix illustrates how security patches must account for backward compatibility constraints in enterprise environments. The vulnerability serves as a reminder of the security implications of seemingly innocuous file operations and demonstrates how database connectivity libraries can inadvertently create information disclosure channels that require careful consideration of platform-specific security models and access controls. Organizations using pgjdbc should prioritize upgrading to supported JDK versions and implementing the temporary directory mitigation strategy to prevent unauthorized access to potentially sensitive data stored in temporary files.