diff options
authorPalle Girgensohn <girgen@FreeBSD.org>2022-02-17 13:12:12 +0000
committerPalle Girgensohn <girgen@FreeBSD.org>2022-02-17 13:14:51 +0000
commite712bd2191da51dfc3830c0119b1a3c1dc4db19d (patch)
parent5459197204873fa6a2070283920eed6c767bce58 (diff)
databases/postgresql-jdbc: update to 42.3.3.
A security advisory has been created for the PostgreSQL JDBC Driver. The URL connection string loggerFile property could be mis-used to create an arbitrary file on the system that the driver is loaded. Additionally anything in the connection string will be logged and subsequently written into that file. In an insecure system it would be possible to execute this file through a webserver. While we do not consider this a security issue with the driver, we have decided to remove the loggerFile and loggerLevel connection properties in the next release of the driver. Removal of those properties does not make exposing the JDBC URL or connection properties to an attacker safe and we continue to suggest that applications do not allow untrusted users to specify arbitrary connection properties. We are removing them to prevent misuse and their functionality can be delegated to java.util.logging. The changelog is not very useful as the change was done behind a security advisory. The short version is that loggerFile and loggerLevel properties still exist but do not do anything. Security: https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8
2 files changed, 4 insertions, 4 deletions
diff --git a/databases/postgresql-jdbc/Makefile b/databases/postgresql-jdbc/Makefile
index cfaf2a78928a..f6e08fa6f655 100644
--- a/databases/postgresql-jdbc/Makefile
+++ b/databases/postgresql-jdbc/Makefile
@@ -1,7 +1,7 @@
# Created by: Palle Girgensohn <girgen@partitur.se>
PORTNAME= postgresql
CATEGORIES= databases java
MASTER_SITES= http://jdbc.postgresql.org/download/
diff --git a/databases/postgresql-jdbc/distinfo b/databases/postgresql-jdbc/distinfo
index fc58d3ce4a15..97eedd616464 100644
--- a/databases/postgresql-jdbc/distinfo
+++ b/databases/postgresql-jdbc/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1635606114
-SHA256 (postgresql-42.3.1.jar) = 8370570857da86eb4a76dd3d8505d34bac0c18186741fa83a6820a10fa441cb4
-SIZE (postgresql-42.3.1.jar) = 1015689
+TIMESTAMP = 1645102191
+SHA256 (postgresql-42.3.3.jar) = eed0604f512ba44817954de99a07e2a5470aa4bfcb481d4e63a93e0ff0e0aede
+SIZE (postgresql-42.3.3.jar) = 1039047