[🐸 Frogbot] Update version of org.postgresql:postgresql to 42.3.3

[github-actions]

📦 Vulnerable Dependencies

Severity	ID	Contextual Analysis	Direct Dependencies	Impacted Dependency	Fixed Versions
Critical	CVE-2022-26520	Applicable	org.postgresql:postgresql:42.2.5	org.postgresql:postgresql 42.2.5	[42.3.3]

🔖 Details

Vulnerability Details

Jfrog Research Severity:	Low
Contextual Analysis:	Applicable
Direct Dependencies:	org.postgresql:postgresql:42.2.5
Impacted Dependency:	org.postgresql:postgresql:42.2.5
Fixed Versions:	[42.3.3]
CVSS V3:	9.8

An unsafe deserialization in pgjdbc leads to arbitrary file overwrite when an attacker can control the pgjdbc configuration.

🔬 JFrog Research Details

Description:
pgjdbc is an Open source JDBC driver written in Pure Java, which allows Java programs to connect to a PostgreSQL database using standard, database independent Java code.

The Java client that connects to the PostgreSQL DB needs to be configured with parameters such as the database host, database credentials and more.
It was discovered to two of these configuration parameters, specifically loggerFile and loggerLevel can cause arbitrary file overwrite on the Java client, if they are externally controlled.
The vulnerability was disputed, since it is a security vulnerability in itself to expose JDBC connection parameters to untrusted input

The vulnerability can only be exploited when the loggerFile and loggerLevel connection properties can be controlled by an attacker. These properties are specified in the host, either explicitly in code -

Properties props = new Properties();
props.setProperty("loggerLevel", "DEBUG");
props.setProperty("loggerFile", "/path/to/file");
con = DriverManager.getConnection(TestUtil.getURL(), props)

Or via a connection URL in code -

String url = "jdbc:postgresql://localhost:5432/postgres?user=test&password=test&loggerLevel=DEBUG&loggerFile=/path/to/file";

Connection conn = DriverManager.getConnection(url);

A public exploit exists that demonstrates writing a JSP webshell, which allows the attacker to run arbitrary shell commands on the victim (in cases where the servlet supports JSP)

---

🐸 JFrog Frogbot