PostgreSQL Postgresql Jdbc Driver any version

pgjdbc SQL Injection via line comment generation

Unchecked Class Instantiation when providing Plugin Classes

In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties

pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

Silent channel-binding authentication downgrade via unsupported certificate algorithms

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc

PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.

pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc