CVE-2022-31197 in pgjdbc transitive dependency (requires manual dependency override)

[dbahatSAP]

Hi,

Following decision by both pgjdbc maintainers and spring boot team, security issue CVE-2022-31197 in pgjdbc will only get patched with the release of spring boot 3 in a few months.
To mitigate, can we please manually override postgresql.version with version >= 42.4.1 like was suggested by both teams?

Thanks,
-David

[onobc]

We will look into doing this in 2.10.0-M2 which should be avaliable in ~2wks.

[dbahatSAP]

since it's a security issue, would be great if you can also backport into the latest stable release

[onobc]

Thanks for the report @dbahatSAP (I forgot to say that initially).

Yes, we will look into the CVE to see if it is one that would affect SCDF. If so, we will then most likely release a patch w/ the 42.4.2. I created #5063 prior to the investigation so that you can have visibility on that as well.

Some further info:

• SCDF 2.9.x uses SB 2.5.14 -> 42.2.25
• SCDF 2.10.x uses SB 2.7.3 -> 42.3.6

Latest org.postgresql:postgresql:42.4.2

[dbahatSAP]

Thanks! Actually for SCDF 2.9.x we can upgrade a minor version to 42.2.26 (it's just the 42.3.x generation that will remain without a fix)

[onobc]

That's good to know @dbahatSAP - I will comment in that ticket.