Exasol JDBC Driver Validates Custom Socket Factory Class Before Initialization
Details
| Detail name | Value |
|---|---|
| Changelog Number | 31996 |
| Type | Bug |
| Status | Resolved |
| Affected Versions | JDBC 24.0.0 |
| Fix Versions | JDBC 26.2.9 |
| Resolution Date | 2026-09-04 |
Description
The Exasol JDBC driver supports specifying a custom socket factory using the socketfactory connection property.
Previously, a user-provided socket factory class could be initialized before verifying that the class was of the expected SocketFactory type. This could allow initialization or constructor code of an unexpected class available on the application's classpath to be executed.
Workaround
Ensure that JDBC connection URLs and connection properties are obtained only from trusted sources. Do not allow untrusted users or external inputs to control the socketfactory connection property.
Fix
The Exasol JDBC driver now validates a user-provided socket factory class to ensure that it is of the expected SocketFactory type before initialization and instantiation.
If the class does not match the expected type, the connection attempt is rejected without initializing or instantiating the provided class.
Acknowledgement
We thank Fushuling and racerZ for responsible disclosure of this vulnerability to Exasol.
