# CVE-2022-31197: SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc > SQL injection in pgjdbc allows attackers to execute arbitrary SQL commands via malicious column names when refreshRow is invoked. - **Severity:** High 7.1 (`CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Over the internet - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 3 Aug 2022 - **Updated:** 3 Nov 2025 - **Also known as:** ALSA-2023:0318, BIT-postgresql-jdbc-driver-2022-31197, CLEANSTART-2026-IG03910, DEBIAN-CVE-2022-31197, DLA-3140-1, GHSA-r38f-c4h4-hqq2, MINI-4gwc-6v9c-x7ww, MINI-6m3g-q98g-2jg9, MINI-73xw-vm44-4rjx, OESA-2022-1835, RHSA-2023:0318, RLSA-2023:0318, SUSE-SU-2022:3537-1, SUSE-SU-2022:3541-1, SUSE-SU-2022:3613-1, SUSE-SU-2022:3705-1, UBUNTU-CVE-2022-31197, openSUSE-SU-2024:12369-1 ## What is CVE-2022-31197? CVE-2022-31197 is a high-severity SQL injection vulnerability in Debian Debian Linux, published on 3 Aug 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link. ### Official description PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted. User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet. Note that the application's JDBC user and the schema owner need not be the same. A JDBC application that executes as a privileged user querying database schemas owned by potentially malicious less-privileged users would be vulnerable. In that situation it may be possible for the malicious user to craft a schema that causes the application to execute commands as the privileged user. Patched versions will be released as `42.2.26` and `42.4.1`. Users are advised to upgrade. There are no known workarounds for this issue. Weakness: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) ## Which versions are affected by CVE-2022-31197? 7 open source packages ship an affected version, including org.postgresql:postgresql and postgresql-jdbc-driver. It affects 3 products. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `org.postgresql:postgresql` | Maven | All versions | 42.2.26 | | `org.postgresql:postgresql` | Maven | All versions | 42.2.26 | | `org.postgresql:postgresql` | Maven | From 42.3.0 | 42.3.7 | | `org.postgresql:postgresql` | Maven | From 42.3.0 | 42.3.7 | | `org.postgresql:postgresql` | Maven | From 42.4.0 | 42.4.1 | | `org.postgresql:postgresql` | Maven | From 42.4.0 | 42.4.1 | | `postgresql-jdbc-driver` | Bitnami | All versions to 42.4.0 | 42.2.26, 42.3.7 | | `postgresql-jdbc` | AlmaLinux:9 | All versions | 42.2.18-6.el9_1 | | `postgresql-jdbc` | Red Hat:enterprise_linux:9::appstream | All versions | 0:42.2.18-6.el9_1 | | `postgresql-jdbc` | Rocky Linux:9 | All versions | 0:42.2.18-6.el9_1 | | `postgresql-jdbc` | SUSE:Linux Enterprise Module for Server Applications 15 SP3 | All versions | 42.2.25-150300.3.8.1 | | `postgresql-jdbc` | SUSE:Linux Enterprise Module for Server Applications 15 SP4 | All versions | 42.2.25-150400.3.6.1 | | `postgresql-jdbc` | SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 9.4-3.6.3 | | `postgresql-jdbc` | SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 9.4-3.6.3 | | `postgresql-jdbc` | SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 9.4-3.6.3 | | `postgresql-jdbc` | SUSE:Linux Enterprise Server 12 SP5 | All versions | 9.4-3.6.3 | | `postgresql-jdbc` | SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 9.4-3.6.3 | | `postgresql-jdbc` | SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 9.4-3.6.3 | | `postgresql-jdbc` | SUSE:Manager Server Module 4.1 | All versions | 42.2.10-150200.3.11.1 | | `postgresql-jdbc` | SUSE:Manager Server Module 4.2 | All versions | 42.2.25-150300.3.8.1 | | `postgresql-jdbc` | SUSE:OpenStack Cloud 9 | All versions | 9.4-3.6.3 | | `postgresql-jdbc` | SUSE:OpenStack Cloud Crowbar 9 | All versions | 9.4-3.6.3 | | `postgresql-jdbc` | openSUSE:Leap 15.3 | All versions | 42.2.25-150300.3.8.1 | | `postgresql-jdbc` | openSUSE:Leap 15.4 | All versions | 42.2.25-150400.3.6.1 | Products: Debian Debian Linux, Fedoraproject Fedora, Postgresql Postgresql Jdbc Driver. ## How do I fix CVE-2022-31197? Upgrade org.postgresql:postgresql to a fixed version for your release line: 42.2.26, 42.3.7 or 42.4.1. ## Is CVE-2022-31197 being exploited? It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31197 exists. ## Other vulnerabilities in Debian Debian Linux - [CVE-2015-3306](https://insights.sbomify.com/CVE-2015-3306/): ProFTPD Improper Access Control (critical 10.0, exploited in the wild) - [CVE-2025-49113](https://insights.sbomify.com/CVE-2025-49113/): RoundCube Webmail Deserialization of Untrusted Data (critical 9.9, exploited in the wild) - [CVE-2026-24061](https://insights.sbomify.com/CVE-2026-24061/): GNU InetUtils Argument Injection (critical 9.8, exploited in the wild) - [CVE-2025-39682](https://insights.sbomify.com/CVE-2025-39682/): Linux Kernel Improper Check for Unusual or Exceptional Conditions (critical 9.8, exploited in the wild) - [CVE-2024-9680](https://insights.sbomify.com/CVE-2024-9680/): Mozilla Firefox Use-After-Free (critical 9.8, exploited in the wild) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2022-31197 and fix it if it is affected. What it is: CVE-2022-31197 is a high-severity SQL injection vulnerability in Debian Debian Linux, published on 3 Aug 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link. Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31197 exists. Affected packages and fixed versions: - org.postgresql:postgresql (Maven): affected all versions; fixed in 42.2.26 - org.postgresql:postgresql (Maven): affected all versions; fixed in 42.2.26 - org.postgresql:postgresql (Maven): affected from 42.3.0; fixed in 42.3.7 - org.postgresql:postgresql (Maven): affected from 42.3.0; fixed in 42.3.7 - org.postgresql:postgresql (Maven): affected from 42.4.0; fixed in 42.4.1 - org.postgresql:postgresql (Maven): affected from 42.4.0; fixed in 42.4.1 - postgresql-jdbc-driver (Bitnami): affected all versions up to 42.4.0; fixed in 42.2.26, 42.3.7 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2022-31197/ (Markdown: https://insights.sbomify.com/CVE-2022-31197/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2022-31197 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-31197 - OSV: https://osv.dev/vulnerability/CVE-2022-31197 --- From sbomify Insights: https://insights.sbomify.com/CVE-2022-31197/ Summaries are generated and may contain mistakes; the official description above is the record.