1
0
mirror of https://git.FreeBSD.org/ports.git synced 2024-11-26 00:55:14 +00:00

databases/postgresql-jdbc: update to 42.3.3.

A security advisory has been created for the PostgreSQL JDBC Driver. The
URL connection string loggerFile property could be mis-used to create an
arbitrary file on the system that the driver is loaded. Additionally
anything in the connection string will be logged and subsequently
written into that file. In an insecure system it would be possible to
execute this file through a webserver.

While we do not consider this a security issue with the driver, we have
decided to remove the loggerFile and loggerLevel connection properties
in the next release of the driver. Removal of those properties does not
make exposing the JDBC URL or connection properties to an attacker safe
and we continue to suggest that applications do not allow untrusted
users to specify arbitrary connection properties.

We are removing them to prevent misuse and their functionality can be
delegated to java.util.logging. The changelog is not very useful as the
change was done behind a security advisory. The short version is that
loggerFile and loggerLevel properties still exist but do not do
anything.

Security:	https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8
This commit is contained in:
Palle Girgensohn 2022-02-17 14:12:12 +01:00
parent 5459197204
commit e712bd2191
2 changed files with 4 additions and 4 deletions

View File

@ -1,7 +1,7 @@
# Created by: Palle Girgensohn <girgen@partitur.se>
PORTNAME= postgresql
PORTVERSION= 42.3.1
PORTVERSION= 42.3.3
CATEGORIES= databases java
MASTER_SITES= http://jdbc.postgresql.org/download/
PKGNAMESUFFIX= -jdbc

View File

@ -1,3 +1,3 @@
TIMESTAMP = 1635606114
SHA256 (postgresql-42.3.1.jar) = 8370570857da86eb4a76dd3d8505d34bac0c18186741fa83a6820a10fa441cb4
SIZE (postgresql-42.3.1.jar) = 1015689
TIMESTAMP = 1645102191
SHA256 (postgresql-42.3.3.jar) = eed0604f512ba44817954de99a07e2a5470aa4bfcb481d4e63a93e0ff0e0aede
SIZE (postgresql-42.3.3.jar) = 1039047