patch for CVE-2022-31197

Resolves: CVE-2022-31197

postgresql-jdbc-CVE-2022-31197.patch

@@ -0,0 +1,28 @@
+Fix CVE-2022-31197
+
+Source of this commit and more information about it is here:
+https://github.com/pgjdbc/pgjdbc/commit/739e599d52ad80f8dcd6efedc6157859b1a9d637
+
+diff --git a/src/main/java/org/postgresql/jdbc/PgResultSet.java b/src/main/java/org/postgresql/jdbc/PgResultSet.java
+index 28d16b9c..6bbfa968 100644
+--- a/src/main/java/org/postgresql/jdbc/PgResultSet.java
++++ b/src/main/java/org/postgresql/jdbc/PgResultSet.java
+@@ -1351,7 +1351,7 @@ public class PgResultSet implements ResultSet, org.postgresql.PGRefCursorResultS
+       if (i > 1) {
+         selectSQL.append(", ");
+       }
+-      selectSQL.append(pgmd.getBaseColumnName(i));
++      Utils.escapeIdentifier(selectSQL, pgmd.getBaseColumnName(i));
+     }
+     selectSQL.append(" from ").append(onlyTable).append(tableName).append(" where ");
+ 
+@@ -1361,7 +1361,8 @@ public class PgResultSet implements ResultSet, org.postgresql.PGRefCursorResultS
+     for (int i = 0; i < numKeys; i++) {
+ 
+       PrimaryKey primaryKey = primaryKeys.get(i);
+-      selectSQL.append(primaryKey.name).append(" = ?");
++      Utils.escapeIdentifier(selectSQL, primaryKey.name);
++      selectSQL.append(" = ?");
+ 
+       if (i < numKeys - 1) {
+         selectSQL.append(" and ");

postgresql-jdbc.spec

@@ -49,11 +49,12 @@
 Summary:	JDBC driver for PostgreSQL
 Name:		postgresql-jdbc
 Version:    42.3.1
-Release:	3%{?dist}
+Release:	4%{?dist}
 License:	BSD
 URL:		http://jdbc.postgresql.org/
 
 Source0:	https://repo1.maven.org/maven2/org/postgresql/postgresql/%{version}/postgresql-%{version}-jdbc-src.tar.gz
+Patch0: postgresql-jdbc-CVE-2022-31197.patch
 Provides:	pgjdbc = %version-%release
 
 BuildArch:	noarch
@@ -99,6 +100,8 @@ This package contains the API Documentation for %{name}.
 
 mv postgresql-%{version}-jdbc-src/* .
 
+%patch0 -p1
+
 # remove any binary libs
 find -type f \( -name "*.jar" -or -name "*.class" \) | xargs rm -f
 
@@ -163,6 +166,9 @@ opts="-f"
 
 
 %changelog
+* Mon Sep 26 2022 Zuzana Miklankova <zmiklank@redhat.com> - 42.3.1-4
+- patch for CVE-2022-31197
+
 * Sat Feb 05 2022 Jiri Vanek <jvanek@redhat.com> - 42.3.1-3
 - Rebuilt for java-17-openjdk as system jdk