openGauss-server openGauss-connector-jdbc up to 7.0.0-RC3 LogFactory LogFactory.java Class.forName logger code injection

Summaryinfo

A vulnerability, which was classified as critical, was found in openGauss-server openGauss-connector-jdbc. The impacted element is the function Class.forName of the file pgjdbc/src/main/java/org/postgresql/log/LogFactory.java of the component LogFactory. Executing a manipulation of the argument logger can lead to code injection. This vulnerability is tracked as CVE-2026-111440. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in openGauss-server openGauss-connector-jdbc. It has been declared as critical. This vulnerability affects the function Class.forName of the file pgjdbc/src/main/java/org/postgresql/log/LogFactory.java of the component LogFactory. The manipulation of the argument logger with an unknown input leads to a code injection vulnerability. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。 此漏洞自 JDBC 1.1.0引入，影响 1.1.0 及之后的 2.x、3.x、5.x、6.x 各版本及补丁（含 6.0.0 分支最新 6.0.6），以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3，并在 7.0.0-LTS 版本修复。修复在 Class.forName 之后先执行 asSubclass(Log.class)，仅允许 Log 子类进入构造。修复pr见https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423。

The advisory is available at gitcode.com. This vulnerability was named CVE-2026-111440 since 10/16/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059 by the MITRE ATT&CK project.

Upgrading to version 7.0.0-LTS eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• openGauss-server

Name

• openGauss-connector-jdbc

Version

• 1.0
• 1.0.0
• 1.0.1
• 1.1.0
• 2.0
• 2.1.0
• 3.0.0-3.0.0
• 3.0.0-3.0.1
• 3.0.0-3.0.2
• 3.0.0-3.0.3
• 3.0.0-3.0.4
• 3.0.0-3.0.5
• 3.10-3.1.0
• 3.10-3.1.1
• 5.0
• 5.0.0-5.0.0
• 5.0.0-5.0.1
• 5.0.0-5.0.2
• 5.0.0-5.0.3
• 5.0.0-RC1
• 5.1.0
• 6.0.0-6.0.0
• 6.0.0-6.0.1
• 6.0.0-6.0.2
• 6.0.0-6.0.3
• 6.0.0-6.0.4
• 6.0.0-6.0.5
• 6.0.0-6.0.6
• 6.0.0-RC1
• 7.0.0-RC1
• 7.0.0-RC2
• 7.0.0-RC3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion