GHSA-mqjf-5f49-2fjh
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
빠른 조치
GHSA-mqjf-5f49-2fjh — org.geotools.jdbc:gt-jdbc-postgis: 아래 명령으로 수정 버전으로 올리세요.
# pom.xml: bump <version>35.1</version> for org.geotools.jdbc:gt-jdbc-postgis상세
### Summary
An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:
* `jsonArrayContains` function Requires PostGIS 12 or greater with a String or JSON field
For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping.
### Patches
* GeoTools 35.1 * GeoTools 33.5 * GeoTools 34.4
### Mitigation
No mitigation is available:
* To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
### Impact
This vulnerability can lead to execution of arbitrary SQL expressions in the database.
### References
* https://osgeo-org.atlassian.net/browse/GEOT-7958 * https://osgeo-org.atlassian.net/browse/GEOT-7959 * https://github.com/geotools/geotools/pull/5829 * https://osgeo-org.atlassian.net/browse/GEOT-7589
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
35.0 수정 버전: 35.1 # pom.xml: bump <version>35.1</version> for org.geotools.jdbc:gt-jdbc-postgis 34.0 수정 버전: 34.5 # pom.xml: bump <version>34.5</version> for org.geotools.jdbc:gt-jdbc-postgis 30.5 수정 버전: 33.6 # pom.xml: bump <version>33.6</version> for org.geotools.jdbc:gt-jdbc-postgis 참고
- https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjh [WEB]
- https://github.com/geotools/geotools/pull/5829 [WEB]
- https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176 [WEB]
- https://github.com/geotools/geotools [PACKAGE]
- https://github.com/geotools/geotools/releases/tag/33.6 [WEB]
- https://github.com/geotools/geotools/releases/tag/34.5 [WEB]
- https://github.com/geotools/geotools/releases/tag/35.1 [WEB]
- https://osgeo-org.atlassian.net/browse/GEOT-7589 [WEB]
- https://osgeo-org.atlassian.net/browse/GEOT-7958 [WEB]
- https://osgeo-org.atlassian.net/browse/GEOT-7959 [WEB]