Date: Fri, 30 Mar 2012 14:28:02 +0200 From: Jan Lieskovsky <jlieskov@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org> CC: oss-security@...ts.openwall.com, Tom Lane <tgl@...hat.com>, pgsql-jdbc@...tgresql.org, Steffen Dettmer <steffen@...t.de> Subject: CVE DISPUTE notification: postgresql-jdbc: SQL injection due improper escaping of JDBC statement parameters Hello Kurt, Steve, vendors, originally, the following deficiency has been reported by Steffen Dettmer:  http://seclists.org/bugtraq/2012/Mar/125 A SQL injection flaw was found in the way postgresql-jdbc, a JDBC driver for PostgreSQL database, performed escaping of certain JDBC statement parameters. A remote attacker could provide a JDBC statement with specially-crafted parameters, which once processed by the postgresql-jdbc driver would lead to SQL injection. References:  http://lists.opensuse.org/opensuse-security/2012-03/msg00024.html  https://bugzilla.novell.com/show_bug.cgi?id=754273  https://bugzilla.redhat.com/show_bug.cgi?id=807394 Upon further issue investigation and discussion with Tom Lane of PostgreSQL upstream and JDBC driver upstream the following conclusion has been provided: The upstream development team of the JDBC driver for the PostgreSQL database does not consider improper escaping of certain JDBC statement / query parameters, when the JDBC driver of version older than the version of underlying PostgresSQL server is being used, to be a security defect. In general, the JDBC driver for the PostgreSQL database does not promise to work with server releases newer than the driver release. This is NOT an official JDBC driver for PostgreSQL database development team statement yet (in the sense it would reference some upstream document / web page). Anyway, we have got preliminary notification there is a upstream intention to provide such page (document which postgresql-jdbc versions are expected to work correctly with which versions of PostgreSQL database server). Till this is done, please take this post as a clarification of postgresql-jdbc's upstream intentions to dispute the possibly later allocated CVE identifier to this issue (posting this sooner yet one can be allocated to this though some vendors might still be interested in allocation). For now Red Hat Security Response Team decided to agree with the above upstream assessment / pursue the way to upstream conclusion. Though in the future if some further details would appear, forcing us to change this conclusion, we might revisit our decision. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ