Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN843
_____________________________________________________________________

DATE                : 17/08/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running org.geotools:gt-jdbc-postgis (Maven)
                             version prior to 35.1, 34.5, 33.6.
 
=====================================================================
https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjh
_____________________________________________________________________


Unauthenticated SQL injection in the jsonArrayContains filter
function against PostGIS layers

Critical
jodygarnett published GHSA-mqjf-5f49-2fjh

Package
org.geotools:gt-jdbc-postgis (Maven)

Affected versions
35.0
>=34.0
>=33.1

Patched versions
35.1
34.5
33.6


Description

Summary

An SQL Injection Vulnerability has been found when executing OGC
Filters with PostGIS DataStore implementation:

    jsonArrayContains function
    Requires PostGIS 12 or greater with a String or JSON field

For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>)
function writes <value> into generated SQL without escaping.


Patches

    GeoTools 35.1

Mitigation

No mitigation is available at this time: Specifically the
CVE-2023-25158 mitigation of enabling preparedStatements and
disabling encode functions is not effective.


Impact

This vulnerability can lead to execution of arbitrary SQL
expressions in the database.

This is a regression of CVE-2023-25158 for the single
jsonArrayContains function.


References

    https://osgeo-org.atlassian.net/browse/GEOT-7958
    #5829
    CVE-2023-25158

Severity
Critical
9.8/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE ID
No known CVE

Weaknesses
Weakness CWE-89

Credits

    @qquang qquang Reporter
    @mrlihd mrlihd Reporter
    @PhilipPhil PhilipPhil Reporter
    @Quikko Quikko Reporter
    @jodygarnett jodygarnett Remediation developer

=========================================================

+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================