{ "@id": "urn:uuid:fa4e6902-a849-4e45-b51f-1bd543075125", "role": "Document Creator", "author": "https://tuxcare.com", "version": 12, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-03T19:53:00.049011+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1" } } ], "timestamp": "2026-11-03T19:51:00.045033+00:00", "status_notes": "Vulnerability CVE-2012-1618 does not affect version 42.5.0-tuxcare.1 of org.postgresql:postgresql. not_affected \u2014 CVE-2012-1618 affects PostgreSQL JDBC driver versions before 8.2 (old versioning scheme). The target version 42.5.0 already contains the upstream fix from 2006 (commit 6237c152) that properly handles the standard_conforming_strings server parameter. The vulnerable pattern (not checking standard_conforming_strings before escaping parameters) is not present in the current code. The fix was shippe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-1618" }, "impact_statement": "not_affected \u2014 CVE-2012-1618 affects PostgreSQL JDBC driver versions before 8.2 (old versioning scheme). The target version 42.5.0 already contains the upstream fix from 2006 (commit 6237c152) that properly handles the standard_conforming_strings server parameter. The vulnerable pattern (not checking standard_conforming_strings before escaping parameters) is not present in the current code. The fix was shippe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1" } } ], "timestamp": "2026-11-03T12:07:34.733429+00:00", "status_notes": "Vulnerability CVE-2020-13692 does not affect version 42.5.0-tuxcare.1 of org.postgresql:postgresql. CVE-2020-13692 (XXE vulnerability in PostgreSQL JDBC Driver) is not present in the target repository version 42.5.0. The upstream fix commit 14b62aca was already included in the PostgreSQL JDBC 42.5.0 release before TuxCare onboarded this version. The fix introduces secure XML parser configuration through DefaultPGXmlFactoryFactory that disables DOCTYPE declarations, external DTD loading, and external entity processing, completely blocking XXE attacks. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.1212.jre6, < 42.2.13), NVD (< 42.2.13), Snyk (< 42.2.13).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13692" }, "impact_statement": "CVE-2020-13692 (XXE vulnerability in PostgreSQL JDBC Driver) is not present in the target repository version 42.5.0. The upstream fix commit 14b62aca was already included in the PostgreSQL JDBC 42.5.0 release before TuxCare onboarded this version. The fix introduces secure XML parser configuration through DefaultPGXmlFactoryFactory that disables DOCTYPE declarations, external DTD loading, and external entity processing, completely blocking XXE attacks. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.1212.jre6, < 42.2.13), NVD (< 42.2.13), Snyk (< 42.2.13)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1" } } ], "timestamp": "2026-11-03T12:12:40.044104+00:00", "status_notes": "Vulnerability CVE-2022-21724 does not affect version 42.5.0-tuxcare.1 of org.postgresql:postgresql. CVE-2022-21724 is NOT present in this target. The upstream fix (commit f4d0ed69) was already included in PostgreSQL JDBC 42.5.0 release before TuxCare onboarded it. The vulnerability allowed arbitrary class instantiation via connection properties (socketFactory, sslhostnameverifier, authenticationPluginClassName, etc.) without interface validation. The fix adds `.asSubclass(expectedClass)` type checking in ObjectFactory.java line 50, and all 5 vulnerable call sites now pass the expected interface class. The vulnerable pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.1208, < 42.2.25; >= 42.3.0, < 42.3.2), NVD (< 42.2.25; >= 42.3.0, < 42.3.2; = 42.3.2-rc1), Snyk (>= 9.4.1208, < 42.2.25; >= 42.3.0, < 42.3.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-21724" }, "impact_statement": "CVE-2022-21724 is NOT present in this target. The upstream fix (commit f4d0ed69) was already included in PostgreSQL JDBC 42.5.0 release before TuxCare onboarded it. The vulnerability allowed arbitrary class instantiation via connection properties (socketFactory, sslhostnameverifier, authenticationPluginClassName, etc.) without interface validation. The fix adds `.asSubclass(expectedClass)` type checking in ObjectFactory.java line 50, and all 5 vulnerable call sites now pass the expected interface class. The vulnerable pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.1208, < 42.2.25; >= 42.3.0, < 42.3.2), NVD (< 42.2.25; >= 42.3.0, < 42.3.2; = 42.3.2-rc1), Snyk (>= 9.4.1208, < 42.2.25; >= 42.3.0, < 42.3.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1" } } ], "timestamp": "2026-11-03T11:58:00.062525+00:00", "status_notes": "Vulnerability CVE-2022-26520 does not affect version 42.5.0-tuxcare.1 of org.postgresql:postgresql. The target repository (pgjdbc 42.5.0) is NOT AFFECTED by CVE-2022-26520. The vulnerability, which allowed arbitrary file writes through attacker-controlled loggerFile/loggerLevel connection properties, was fixed in the upstream pgjdbc release 42.3.3 (commit f6d47034). This fix was already present in upstream version 42.5.0 before TuxCare onboarded it. The vulnerable code that passed user-controlled file paths to java.util.logging.FileHandler has been completely removed - the setupLoggerFromProperties method is now empty, and FileHandler is not used anywhere in the codebase. The loggerFile and loggerLevel properties are deprecated and ignored.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 42.1.0, < 42.3.3; >= 42.1.0, < 42.3.3), NVD (>= 42.1.0, <= 42.1.4; >= 42.3.0, < 42.3.3), Snyk (>= 42.1.0, < 42.3.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-26520" }, "impact_statement": "The target repository (pgjdbc 42.5.0) is NOT AFFECTED by CVE-2022-26520. The vulnerability, which allowed arbitrary file writes through attacker-controlled loggerFile/loggerLevel connection properties, was fixed in the upstream pgjdbc release 42.3.3 (commit f6d47034). This fix was already present in upstream version 42.5.0 before TuxCare onboarded it. The vulnerable code that passed user-controlled file paths to java.util.logging.FileHandler has been completely removed - the setupLoggerFromProperties method is now empty, and FileHandler is not used anywhere in the codebase. The loggerFile and loggerLevel properties are deprecated and ignored.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 42.1.0, < 42.3.3; >= 42.1.0, < 42.3.3), NVD (>= 42.1.0, <= 42.1.4; >= 42.3.0, < 42.3.3), Snyk (>= 42.1.0, < 42.3.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1" } } ], "timestamp": "2026-11-03T12:04:03.421384+00:00", "status_notes": "Vulnerability CVE-2022-31197 does not affect version 42.5.0-tuxcare.1 of org.postgresql:postgresql. CVE-2022-31197 is NOT present in this version. The vulnerability involves SQL injection via unescaped column names in ResultSet.refreshRow(). The upstream fix (commit 739e599d) that adds Utils.escapeIdentifier() to properly escape column identifiers was already included in the upstream PostgreSQL JDBC 42.5.0 release, predating TuxCare's onboarding of this version. The fix is present at lines 1421 and 1431 of PgResultSet.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 42.2.26; >= 42.4.0, < 42.4.1; >= 42.3.0, < 42.3.7), NVD (< 42.2.26; >= 42.3.0, < 42.3.7; = 42.4.0; = 42.4.0-rc1; = 42.4.1-rc1), cve.org (>= 42.2.0, < 42.2.26; >= 42.3.0, < 42.4.1), Snyk (< 42.2.26; >= 42.3.0, < 42.3.7; >= 42.4.0, < 42.4.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31197" }, "impact_statement": "CVE-2022-31197 is NOT present in this version. The vulnerability involves SQL injection via unescaped column names in ResultSet.refreshRow(). The upstream fix (commit 739e599d) that adds Utils.escapeIdentifier() to properly escape column identifiers was already included in the upstream PostgreSQL JDBC 42.5.0 release, predating TuxCare's onboarding of this version. The fix is present at lines 1421 and 1431 of PgResultSet.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 42.2.26; >= 42.4.0, < 42.4.1; >= 42.3.0, < 42.3.7), NVD (< 42.2.26; >= 42.3.0, < 42.3.7; = 42.4.0; = 42.4.0-rc1; = 42.4.1-rc1), cve.org (>= 42.2.0, < 42.2.26; >= 42.3.0, < 42.4.1), Snyk (< 42.2.26; >= 42.3.0, < 42.3.7; >= 42.4.0, < 42.4.1)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41946 affects version 42.5.0-tuxcare.1 of org.postgresql:postgresql, and is fixed in 42.5.0-tuxcare.2.", "vulnerability": { "name": "CVE-2022-41946" }, "action_statement": "Vulnerability CVE-2022-41946 affects version 42.5.0-tuxcare.1 of org.postgresql:postgresql, and is fixed in 42.5.0-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1597 is fixed in version 42.5.0-tuxcare.1 of org.postgresql:postgresql.", "vulnerability": { "name": "CVE-2024-1597" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1" } } ], "timestamp": "2026-11-03T19:53:00.049011+00:00", "status_notes": "Vulnerability CVE-2025-49146 does not affect version 42.5.0-tuxcare.1 of org.postgresql:postgresql. not_affected \u2014 Version 42.5.0 is not affected by CVE-2025-49146. The vulnerability describes a bug where the driver incorrectly allows non-channel-binding authentication methods when channelBinding is configured as 'required'. However, version 42.5.0 does not have a channelBinding configuration property at all - the feature does not exist in this version. The channel binding mechanism and enforcement logic de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-49146" }, "impact_statement": "not_affected \u2014 Version 42.5.0 is not affected by CVE-2025-49146. The vulnerability describes a bug where the driver incorrectly allows non-channel-binding authentication methods when channelBinding is configured as 'required'. However, version 42.5.0 does not have a channelBinding configuration property at all - the feature does not exist in this version. The channel binding mechanism and enforcement logic de..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42198 affects version 42.5.0-tuxcare.1 of org.postgresql:postgresql.", "vulnerability": { "name": "CVE-2026-42198" }, "action_statement": "Vulnerability CVE-2026-42198 affects version 42.5.0-tuxcare.1 of org.postgresql:postgresql." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1" } } ], "timestamp": "2026-10-29T00:36:14.768306+00:00", "status_notes": "Vulnerability CVE-2026-54291 affects version 42.5.0-tuxcare.1 of org.postgresql:postgresql.", "vulnerability": { "name": "CVE-2026-54291" }, "action_statement": "Vulnerability CVE-2026-54291 affects version 42.5.0-tuxcare.1 of org.postgresql:postgresql." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1" } } ], "timestamp": "2026-11-01T22:54:00.174145+00:00", "status_notes": "Vulnerability GHSA-673j-qm5f-xpv8 does not affect version 42.5.0-tuxcare.1 of org.postgresql:postgresql. not_affected \u2014 The target repository is NOT AFFECTED by GHSA-673j-qm5f-xpv8. The vulnerability involved arbitrary file write via the loggerFile connection parameter, which allowed attackers to specify a malicious file path (e.g., a JSP file with embedded code). The upstream fix (commit f6d47034) removed the vulnerable code that created java.util.logging.FileHandler with user-supplied filenames. This fix was a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-673j-qm5f-xpv8" }, "impact_statement": "not_affected \u2014 The target repository is NOT AFFECTED by GHSA-673j-qm5f-xpv8. The vulnerability involved arbitrary file write via the loggerFile connection parameter, which allowed attackers to specify a malicious file path (e.g., a JSP file with embedded code). The upstream fix (commit f6d47034) removed the vulnerable code that created java.util.logging.FileHandler with user-supplied filenames. This fix was a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.postgresql/postgresql@42.5.0-tuxcare.1" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-xfg6-62px-cxc2 is a false positive for org.postgresql:postgresql 42.5.0-tuxcare.1.", "vulnerability": { "name": "GHSA-xfg6-62px-cxc2" }, "impact_statement": "The vulnerability has been withdrawn." } ] }