Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package postgresql-jdbc for openSUSE:Factory
checked in at 2022-06-04 23:26:55
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/postgresql-jdbc (Old)
and /work/SRC/openSUSE:Factory/.postgresql-jdbc.new.1548 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "postgresql-jdbc"
Sat Jun 4 23:26:55 2022 rev:3 rq:980650 version:42.2.25
Changes:
--------
--- /work/SRC/openSUSE:Factory/postgresql-jdbc/postgresql-jdbc.changes
2022-03-05 16:27:40.359903571 +0100
+++
/work/SRC/openSUSE:Factory/.postgresql-jdbc.new.1548/postgresql-jdbc.changes
2022-06-04 23:26:58.996752623 +0200
@@ -1,0 +2,7 @@
+Fri Jun 3 10:34:36 UTC 2022 - Michael Calmer <[email protected]>
+
+- Address arbitrary File Write Vulnerability CVE-2022-26520
+ (bsc#1197356)
+ * Add: CVE-2022-26520.patch
+
+-------------------------------------------------------------------
New:
----
CVE-2022-26520.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ postgresql-jdbc.spec ++++++
--- /var/tmp/diff_new_pack.li4pwg/_old 2022-06-04 23:26:59.460753092 +0200
+++ /var/tmp/diff_new_pack.li4pwg/_new 2022-06-04 23:26:59.460753092 +0200
@@ -1,7 +1,7 @@
#
# spec file for package postgresql-jdbc
#
-# Copyright (c) 2020 SUSE LLC
+# Copyright (c) 2022 SUSE LLC
# Copyright (c) 2000-2005, JPackage Project
#
# All modifications and additions to the file contributed by third parties
@@ -24,6 +24,7 @@
License: BSD-2-Clause
URL: https://jdbc.postgresql.org/
Source0:
https://repo1.maven.org/maven2/org/postgresql/postgresql/%{version}/postgresql-%{version}-jdbc-src.tar.gz
+Patch1: CVE-2022-26520.patch
BuildRequires: fdupes
BuildRequires: maven-local
BuildRequires: mvn(com.ongres.scram:client) >= 2.0
@@ -42,6 +43,7 @@
%prep
%setup -q -n postgresql-%{version}-jdbc-src
+%patch1 -p1
# Build parent POMs in the same Maven call.
%pom_xpath_remove "pom:plugin[pom:artifactId = 'maven-shade-plugin']"
++++++ CVE-2022-26520.patch ++++++
>From f6d47034a4ce292e1a659fa00963f6f713117064 Mon Sep 17 00:00:00 2001
From: Sehrope Sarkuni <[email protected]>
Date: Tue, 15 Feb 2022 09:51:56 -0500
Subject: [PATCH] Merge pull request from GHSA-673j-qm5f-xpv8
Removes loggerFile and loggerLevel properties and defers to java.util.logging to
configure all logging in the driver. Users that previously specifyied custom
logging via those connection properties should change their applications to
instead configure via a java.util.logging properties file or system properties.
The properties and enum values are now deprecated and may be removed in a future
driver version.
Co-authored-by: Dave Cramer <[email protected]>
---
README.md | 7 +-
docs/documentation/head/connect.md | 12 +--
.../src/main/java/org/postgresql/Driver.java | 74 +-----------------
.../main/java/org/postgresql/PGProperty.java | 22 +-----
.../postgresql/ds/common/BaseDataSource.java | 20 +++--
.../org/postgresql/test/jdbc2/DriverTest.java | 67 ----------------
.../postgresql/test/jdbc2/PGPropertyTest.java | 10 ---
.../postgresql/test/jdbc4/Jdbc4TestSuite.java | 1 -
.../org/postgresql/test/jdbc4/LogTest.java | 78 -------------------
9 files changed, 28 insertions(+), 263 deletions(-)
delete mode 100644 pgjdbc/src/test/java/org/postgresql/test/jdbc4/LogTest.java
Index: postgresql-42.2.25-jdbc-src/README.md
===================================================================
--- postgresql-42.2.25-jdbc-src.orig/README.md
+++ postgresql-42.2.25-jdbc-src/README.md
@@ -103,6 +103,11 @@ where:
* **database** (Optional) is the database name. Defaults to the same name as
the *user name* used in the connection.
* **propertyX** (Optional) is one or more option connection properties. For
more information see *Connection properties*.
+### Logging
+PgJDBC uses java.util.logging for logging.
+To configure log levels and control log output destination (e.g. file or
console), configure your java.util.logging properties accordingly for the
org.postgresql logger.
+Note that the most detailed log levels, "`FINEST`", may include sensitive
information such as connection details, query SQL, or command parameters.
+
#### Connection Properties
In addition to the standard connection parameters the driver supports a number
of additional properties which can be used to specify additional driver
behaviour specific to PostgreSQL???. These properties may be specified in
either the connection URL or an additional Properties object parameter to
DriverManager.getConnection.
@@ -123,8 +128,6 @@ In addition to the standard connection p
| sslpassword | String | null | The password for the
client's ssl key (ignored if sslpasswordcallback is set) |
| sendBufferSize | Integer | -1 | Socket write buffer size
|
| receiveBufferSize | Integer | -1 | Socket read buffer size
|
-| loggerLevel | String | null | Logger level of the
driver using java.util.logging. Allowed values: OFF, DEBUG or TRACE. |
-| loggerFile | String | null | File name output of the
Logger, if set, the Logger will use a FileHandler to write to a specified file.
If the parameter is not set or the file can't be created the ConsoleHandler
will be used instead. |
| logServerErrorDetail | Boolean | true | Allows server error
detail (such as sql statements and values) to be logged and passed on in
exceptions. Setting to false will mask these errors so they won't be exposed
to users, or logs. |
| allowEncodingChanges | Boolean | false | Allow for changes in
client_encoding |
| logUnclosedConnections | Boolean | false | When connections that
are not explicitly closed are garbage collected, log the stacktrace from the
opening of the connection to trace the leak source |
Index: postgresql-42.2.25-jdbc-src/src/main/java/org/postgresql/Driver.java
===================================================================
--- postgresql-42.2.25-jdbc-src.orig/src/main/java/org/postgresql/Driver.java
+++ postgresql-42.2.25-jdbc-src/src/main/java/org/postgresql/Driver.java
@@ -9,10 +9,8 @@ import static org.postgresql.util.intern
import org.postgresql.jdbc.PgConnection;
import org.postgresql.util.DriverInfo;
-import org.postgresql.util.ExpressionProperties;
import org.postgresql.util.GT;
import org.postgresql.util.HostSpec;
-import org.postgresql.util.LogWriterHandler;
import org.postgresql.util.PSQLException;
import org.postgresql.util.PSQLState;
import org.postgresql.util.SharedTimer;
@@ -36,11 +34,8 @@ import java.util.Enumeration;
import java.util.Properties;
import java.util.Set;
import java.util.concurrent.TimeUnit;
-import java.util.logging.Formatter;
import java.util.logging.Level;
import java.util.logging.Logger;
-import java.util.logging.SimpleFormatter;
-import java.util.logging.StreamHandler;
/**
* <p>The Java SQL framework allows for multiple database drivers. Each driver
should supply a class
@@ -246,8 +241,6 @@ public class Driver implements java.sql.
return null;
}
try {
- // Setup java.util.logging.Logger using connection properties.
- setupLoggerFromProperties(props);
LOGGER.log(Level.FINE, "Connecting with URL: {0}", url);
@@ -288,73 +281,13 @@ public class Driver implements java.sql.
}
}
- // Used to check if the handler file is the same
- private static /* @Nullable */ String loggerHandlerFile;
-
/**
- * <p>Setup java.util.logging.Logger using connection properties.</p>
- *
- * <p>See {@link PGProperty#LOGGER_FILE} and {@link
PGProperty#LOGGER_FILE}</p>
- *
+ * this is an empty method left here for graalvm
+ * we removed the ability to setup the logger from properties
+ * due to a security issue
* @param props Connection Properties
*/
private void setupLoggerFromProperties(final Properties props) {
- final String driverLogLevel = PGProperty.LOGGER_LEVEL.get(props);
- if (driverLogLevel == null) {
- return; // Don't mess with Logger if not set
- }
- if ("OFF".equalsIgnoreCase(driverLogLevel)) {
- PARENT_LOGGER.setLevel(Level.OFF);
- return; // Don't mess with Logger if set to OFF
- } else if ("DEBUG".equalsIgnoreCase(driverLogLevel)) {
- PARENT_LOGGER.setLevel(Level.FINE);
- } else if ("TRACE".equalsIgnoreCase(driverLogLevel)) {
- PARENT_LOGGER.setLevel(Level.FINEST);
- }
-
- ExpressionProperties exprProps = new ExpressionProperties(props,
System.getProperties());
- final String driverLogFile = PGProperty.LOGGER_FILE.get(exprProps);
- if (driverLogFile != null && driverLogFile.equals(loggerHandlerFile)) {
- return; // Same file output, do nothing.
- }
-
- for (java.util.logging.Handler handlers : PARENT_LOGGER.getHandlers()) {
- // Remove previously set Handlers
- handlers.close();
- PARENT_LOGGER.removeHandler(handlers);
- loggerHandlerFile = null;
- }
-
- java.util.logging.Handler handler = null;
- if (driverLogFile != null) {
- try {
- handler = new java.util.logging.FileHandler(driverLogFile);
- loggerHandlerFile = driverLogFile;
- } catch (Exception ex) {
- System.err.println("Cannot enable FileHandler, fallback to
ConsoleHandler.");
- }
- }
-
- Formatter formatter = new SimpleFormatter();
-
- if ( handler == null ) {
- if (DriverManager.getLogWriter() != null) {
- handler = new LogWriterHandler(DriverManager.getLogWriter());
- } else if ( DriverManager.getLogStream() != null) {
- handler = new StreamHandler(DriverManager.getLogStream(), formatter);
- } else {
- handler = new StreamHandler(System.err, formatter);
- }
- } else {
- handler.setFormatter(formatter);
- }
-
- Level loggerLevel = PARENT_LOGGER.getLevel();
- if (loggerLevel != null) {
- handler.setLevel(loggerLevel);
- }
- PARENT_LOGGER.setUseParentHandlers(false);
- PARENT_LOGGER.addHandler(handler);
}
/**
Index: postgresql-42.2.25-jdbc-src/src/main/java/org/postgresql/PGProperty.java
===================================================================
---
postgresql-42.2.25-jdbc-src.orig/src/main/java/org/postgresql/PGProperty.java
+++ postgresql-42.2.25-jdbc-src/src/main/java/org/postgresql/PGProperty.java
@@ -252,11 +252,8 @@ public enum PGProperty {
"If disabled hosts are connected in the given order. If enabled hosts are
chosen randomly from the set of suitable candidates"),
/**
- * <p>File name output of the Logger, if set, the Logger will use a
- * {@link java.util.logging.FileHandler} to write to a specified file. If
the parameter is not set
- * or the file can't be created the {@link java.util.logging.ConsoleHandler}
will be used instead.</p>
- *
- * <p>Parameter should be use together with {@link
PGProperty#LOGGER_LEVEL}</p>
+ * This property is no longer used by the driver and will be ignored.
+ * Logging is configured via java.util.logging.
*/
LOGGER_FILE(
"loggerFile",
@@ -264,19 +261,8 @@ public enum PGProperty {
"File name output of the Logger"),
/**
- * <p>Logger level of the driver. Allowed values: {@code OFF}, {@code DEBUG}
or {@code TRACE}.</p>
- *
- * <p>This enable the {@link java.util.logging.Logger} of the driver based
on the following mapping
- * of levels:</p>
- * <ul>
- * <li>FINE -> DEBUG</li>
- * <li>FINEST -> TRACE</li>
- * </ul>
- *
- * <p><b>NOTE:</b> The recommended approach to enable java.util.logging is
using a
- * {@code logging.properties} configuration file with the property
- * {@code -Djava.util.logging.config.file=myfile} or if your are using an
application server
- * you should use the appropriate logging subsystem.</p>
+ * This property is no longer used by the driver and will be ignored.
+ * Logging is configured via java.util.logging.
*/
LOGGER_LEVEL(
"loggerLevel",
Index:
postgresql-42.2.25-jdbc-src/src/main/java/org/postgresql/ds/common/BaseDataSource.java
===================================================================
---
postgresql-42.2.25-jdbc-src.orig/src/main/java/org/postgresql/ds/common/BaseDataSource.java
+++
postgresql-42.2.25-jdbc-src/src/main/java/org/postgresql/ds/common/BaseDataSource.java
@@ -1176,34 +1176,38 @@ public abstract class BaseDataSource imp
}
/**
- * @return Logger Level of the JDBC Driver
- * @see PGProperty#LOGGER_LEVEL
+ * This property is no longer used by the driver and will be ignored.
+ * @deprecated Configure via java.util.logging
*/
+ @Deprecated
public /* @Nullable */ String getLoggerLevel() {
return PGProperty.LOGGER_LEVEL.get(properties);
}
/**
- * @param loggerLevel of the JDBC Driver
- * @see PGProperty#LOGGER_LEVEL
+ * This property is no longer used by the driver and will be ignored.
+ * @deprecated Configure via java.util.logging
*/
+ @Deprecated
public void setLoggerLevel(/* @Nullable */ String loggerLevel) {
PGProperty.LOGGER_LEVEL.set(properties, loggerLevel);
}
/**
- * @return File output of the Logger.
- * @see PGProperty#LOGGER_FILE
+ * This property is no longer used by the driver and will be ignored.
+ * @deprecated Configure via java.util.logging
*/
+ @Deprecated
public /* @Nullable */ String getLoggerFile() {
ExpressionProperties exprProps = new ExpressionProperties(properties,
System.getProperties());
return PGProperty.LOGGER_FILE.get(exprProps);
}
/**
- * @param loggerFile File output of the Logger.
- * @see PGProperty#LOGGER_LEVEL
+ * This property is no longer used by the driver and will be ignored.
+ * @deprecated Configure via java.util.logging
*/
+ @Deprecated
public void setLoggerFile(/* @Nullable */ String loggerFile) {
PGProperty.LOGGER_FILE.set(properties, loggerFile);
}
Index:
postgresql-42.2.25-jdbc-src/src/test/java/org/postgresql/test/jdbc2/DriverTest.java
===================================================================
---
postgresql-42.2.25-jdbc-src.orig/src/test/java/org/postgresql/test/jdbc2/DriverTest.java
+++
postgresql-42.2.25-jdbc-src/src/test/java/org/postgresql/test/jdbc2/DriverTest.java
@@ -15,13 +15,10 @@ import static org.junit.Assert.fail;
import org.postgresql.Driver;
import org.postgresql.PGProperty;
import org.postgresql.test.TestUtil;
-import org.postgresql.util.LogWriterHandler;
-import org.postgresql.util.NullOutputStream;
import org.postgresql.util.URLCoder;
import org.junit.Test;
-import java.io.PrintWriter;
import java.lang.reflect.Method;
import java.sql.Connection;
import java.sql.DriverManager;
@@ -29,8 +26,6 @@ import java.sql.SQLException;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Properties;
-import java.util.logging.Handler;
-import java.util.logging.Logger;
/*
* Tests the dynamically created class org.postgresql.Driver
@@ -213,68 +208,6 @@ public class DriverTest {
fail("Driver has not been found in DriverManager's list but it should be
registered");
}
- @Test
- public void testSetLogWriter() throws Exception {
-
- // this is a dummy to make sure TestUtil is initialized
- Connection con = DriverManager.getConnection(TestUtil.getURL(),
TestUtil.getUser(), TestUtil.getPassword());
- con.close();
- String loggerLevel = System.getProperty("loggerLevel");
- String loggerFile = System.getProperty("loggerFile");
-
- PrintWriter prevLog = DriverManager.getLogWriter();
- try {
- PrintWriter printWriter = new PrintWriter(new
NullOutputStream(System.err));
- DriverManager.setLogWriter(printWriter);
- assertEquals(DriverManager.getLogWriter(), printWriter);
- System.clearProperty("loggerFile");
- System.clearProperty("loggerLevel");
- Properties props = new Properties();
- props.setProperty("user", TestUtil.getUser());
- props.setProperty("password", TestUtil.getPassword());
- props.setProperty("loggerLevel", "DEBUG");
- con = DriverManager.getConnection(TestUtil.getURL(), props);
-
- Logger logger = Logger.getLogger("org.postgresql");
- Handler[] handlers = logger.getHandlers();
- assertTrue(handlers[0] instanceof LogWriterHandler );
- con.close();
- } finally {
- DriverManager.setLogWriter(prevLog);
- setProperty("loggerLevel", loggerLevel);
- setProperty("loggerFile", loggerFile);
- }
- }
-
- @Test
- public void testSetLogStream() throws Exception {
- // this is a dummy to make sure TestUtil is initialized
- Connection con = DriverManager.getConnection(TestUtil.getURL(),
TestUtil.getUser(), TestUtil.getPassword());
- con.close();
- String loggerLevel = System.getProperty("loggerLevel");
- String loggerFile = System.getProperty("loggerFile");
-
- try {
- DriverManager.setLogStream(new NullOutputStream(System.err));
- System.clearProperty("loggerFile");
- System.clearProperty("loggerLevel");
- Properties props = new Properties();
- props.setProperty("user", TestUtil.getUser());
- props.setProperty("password", TestUtil.getPassword());
- props.setProperty("loggerLevel", "DEBUG");
- con = DriverManager.getConnection(TestUtil.getURL(), props);
-
- Logger logger = Logger.getLogger("org.postgresql");
- Handler []handlers = logger.getHandlers();
- assertTrue( handlers[0] instanceof LogWriterHandler );
- con.close();
- } finally {
- DriverManager.setLogStream(null);
- setProperty("loggerLevel", loggerLevel);
- setProperty("loggerFile", loggerFile);
- }
- }
-
private void setProperty(String key, String value) {
if (value == null) {
System.clearProperty(key);
Index:
postgresql-42.2.25-jdbc-src/src/test/java/org/postgresql/test/jdbc2/PGPropertyTest.java
===================================================================
---
postgresql-42.2.25-jdbc-src.orig/src/test/java/org/postgresql/test/jdbc2/PGPropertyTest.java
+++
postgresql-42.2.25-jdbc-src/src/test/java/org/postgresql/test/jdbc2/PGPropertyTest.java
@@ -8,7 +8,6 @@ package org.postgresql.test.jdbc2;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
import static org.junit.Assert.assertSame;
import static org.junit.Assert.assertTrue;
@@ -216,15 +215,6 @@ public class PGPropertyTest {
}
@Test
- public void testNullValue() {
- Properties empty = new Properties();
- assertNull(PGProperty.LOGGER_LEVEL.getSetString(empty));
- Properties withLogging = new Properties();
- withLogging.setProperty(PGProperty.LOGGER_LEVEL.getName(), "OFF");
- assertNotNull(PGProperty.LOGGER_LEVEL.getSetString(withLogging));
- }
-
- @Test
public void testEncodedUrlValues() {
String databaseName = "d&a%ta+base";
String userName = "&u%ser";
Index:
postgresql-42.2.25-jdbc-src/src/test/java/org/postgresql/test/jdbc4/LogTest.java
===================================================================
---
postgresql-42.2.25-jdbc-src.orig/src/test/java/org/postgresql/test/jdbc4/LogTest.java
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright (c) 2007, PostgreSQL Global Development Group
- * See the LICENSE file in the project root for more information.
- */
-
-package org.postgresql.test.jdbc4;
-
-import org.postgresql.PGProperty;
-import org.postgresql.test.TestUtil;
-import org.postgresql.test.jdbc2.BaseTest4;
-
-import org.junit.Assert;
-import org.junit.Assume;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-
-import java.sql.Array;
-import java.sql.PreparedStatement;
-import java.sql.ResultSet;
-import java.sql.SQLException;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Properties;
-
-@RunWith(Parameterized.class)
-public class LogTest extends BaseTest4 {
-
- private String oldLevel;
-
- public LogTest(BinaryMode binaryMode) {
- setBinaryMode(binaryMode);
- long maxMemory = Runtime.getRuntime().maxMemory();
- if (maxMemory < 6L * 1024 * 1024 * 1024) {
- // TODO: add hamcrest matches and replace with "greaterThan" or
something like that
- Assume.assumeTrue(
- "The test requires -Xmx6g or more. MaxMemory is " + (maxMemory /
1024.0 / 1024) + " MiB",
- false);
- }
- }
-
- @Parameterized.Parameters(name = "binary = {0}")
- public static Iterable<Object[]> data() {
- Collection<Object[]> ids = new ArrayList<Object[]>();
- for (BinaryMode binaryMode : BinaryMode.values()) {
- ids.add(new Object[]{binaryMode});
- }
- return ids;
- }
-
- @Override
- protected void updateProperties(Properties props) {
- super.updateProperties(props);
- PGProperty.LOGGER_LEVEL.set(props, "TRACE");
- }
-
- @Test
- public void reallyLargeArgumentsBreaksLogging() throws SQLException {
- String[] largeInput = new String[220];
- String largeString = String.format("%1048576s", " ");
- for (int i = 0; i < largeInput.length; i++) {
- largeInput[i] = largeString;
- }
- Array arr = con.createArrayOf("text", largeInput);
- PreparedStatement ps = con.prepareStatement("select t from
unnest(?::text[]) t");
- ps.setArray(1, arr);
- ResultSet rs = ps.executeQuery();
- int x = 0;
- while (rs.next()) {
- x += 1;
- String found = rs.getString(1);
- Assert.assertEquals(largeString, found);
- }
- Assert.assertEquals(largeInput.length, x);
- TestUtil.closeQuietly(rs);
- TestUtil.closeQuietly(ps);
- }
-}
