The PostgreSQL JDBC team have released 42.5.1, 42.4.3, 42.3.8, 42.2.27.jre7 to 
address a security issue: CVE-2022-41946. (Note there is no fix for 
42.2.26.jre6 see the advisory for workarounds)
This is only an issue if you are using PreparedStatement.setText() or 
PreparedStatement.setBytea() where the String or bytea argument is larger than 
51200 bytes. At which point the driver will buffer to disk. To do this it 
creates a temporary file which in previous versions could  be read by other 
users on the client system. Note this only effects unix like systems.  See the 
[security 
advisory](https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-562r-vg33-8x8h)
 for the details. 
Thanks to [Jonathan Leitschuh](https://github.com/JLLeitschuh) for finding and 
reporting the issue.

Reply via email to