Import Debian changes 42.2.15-1+deb11u1

libpgjava (42.2.15-1+deb11u1) bullseye-security; urgency=high
.
  * Team upload.
  * Fix CVE-2022-26520:
    An attacker (who controls the jdbc URL or properties) can call
    java.util.logging.FileHandler to write to arbitrary files through the
    loggerFile and loggerLevel connection properties.
  * Fix CVE-2022-21724:
    The JDBC driver did not verify if certain classes implemented the expected
    interface before instantiating the class. This can lead to code execution
    loaded via arbitrary classes.

debian/changelog

+libpgjava (42.2.15-1+deb11u1) bullseye-security; urgency=high
+
+  * Team upload.
+  * Fix CVE-2022-26520:
+    An attacker (who controls the jdbc URL or properties) can call
+    java.util.logging.FileHandler to write to arbitrary files through the
+    loggerFile and loggerLevel connection properties.
+  * Fix CVE-2022-21724:
+    The JDBC driver did not verify if certain classes implemented the expected
+    interface before instantiating the class. This can lead to code execution
+    loaded via arbitrary classes.
+
+ -- Markus Koschany <apo@debian.org>  Tue, 05 Jul 2022 14:33:43 +0200
+
 libpgjava (42.2.15-1) unstable; urgency=medium
 
   * New upstream version.

debian/patches/CVE-2022-21724.patch

+From: Markus Koschany <apo@debian.org>
+Date: Sun, 3 Jul 2022 19:36:22 +0200
+Subject: CVE-2022-21724
+
+Origin: https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813
+---
+ .../org/postgresql/core/SocketFactoryFactory.java  |   4 +-
+ src/main/java/org/postgresql/ssl/LibPQFactory.java |   2 +-
+ src/main/java/org/postgresql/ssl/MakeSSL.java      |   2 +-
+ .../java/org/postgresql/util/ObjectFactory.java    |   7 +-
+ .../postgresql/test/util/ObjectFactoryTest.java    | 106 +++++++++++++++++++++
+ 5 files changed, 114 insertions(+), 7 deletions(-)
+ create mode 100644 src/test/java/org/postgresql/test/util/ObjectFactoryTest.java
+
+diff --git a/src/main/java/org/postgresql/core/SocketFactoryFactory.java b/src/main/java/org/postgresql/core/SocketFactoryFactory.java
+index 09efa75..fe56354 100644
+--- a/src/main/java/org/postgresql/core/SocketFactoryFactory.java
++++ b/src/main/java/org/postgresql/core/SocketFactoryFactory.java
+@@ -36,7 +36,7 @@ public class SocketFactoryFactory {
+       return SocketFactory.getDefault();
+     }
+     try {
+-      return (SocketFactory) ObjectFactory.instantiate(socketFactoryClassName, info, true,
++      return ObjectFactory.instantiate(SocketFactory.class, socketFactoryClassName, info, true,
+           PGProperty.SOCKET_FACTORY_ARG.get(info));
+     } catch (Exception e) {
+       throw new PSQLException(
+@@ -61,7 +61,7 @@ public class SocketFactoryFactory {
+       return new LibPQFactory(info);
+     }
+     try {
+-      return (SSLSocketFactory) ObjectFactory.instantiate(classname, info, true,
++      return ObjectFactory.instantiate(SSLSocketFactory.class, classname, info, true,
+           PGProperty.SSL_FACTORY_ARG.get(info));
+     } catch (Exception e) {
+       throw new PSQLException(
+diff --git a/src/main/java/org/postgresql/ssl/LibPQFactory.java b/src/main/java/org/postgresql/ssl/LibPQFactory.java
+index 1339cce..7e4dbda 100644
+--- a/src/main/java/org/postgresql/ssl/LibPQFactory.java
++++ b/src/main/java/org/postgresql/ssl/LibPQFactory.java
+@@ -58,7 +58,7 @@ public class LibPQFactory extends WrappedFactory {
+     String sslpasswordcallback = PGProperty.SSL_PASSWORD_CALLBACK.get(info);
+     if (sslpasswordcallback != null) {
+       try {
+-        cbh = (CallbackHandler) ObjectFactory.instantiate(sslpasswordcallback, info, false, null);
++        cbh = (CallbackHandler) MakeSSL.instantiate(CallbackHandler.class, sslpasswordcallback, info, false, null);
+       } catch (Exception e) {
+         throw new PSQLException(
+           GT.tr("The password callback class provided {0} could not be instantiated.",
+diff --git a/src/main/java/org/postgresql/ssl/MakeSSL.java b/src/main/java/org/postgresql/ssl/MakeSSL.java
+index bf64673..849d107 100644
+--- a/src/main/java/org/postgresql/ssl/MakeSSL.java
++++ b/src/main/java/org/postgresql/ssl/MakeSSL.java
+@@ -64,7 +64,7 @@ public class MakeSSL extends ObjectFactory {
+       sslhostnameverifier = "PgjdbcHostnameVerifier";
+     } else {
+       try {
+-        hvn = (HostnameVerifier) instantiate(sslhostnameverifier, info, false, null);
++        hvn = instantiate(HostnameVerifier.class, sslhostnameverifier, info, false, null);
+       } catch (Exception e) {
+         throw new PSQLException(
+             GT.tr("The HostnameVerifier class provided {0} could not be instantiated.",
+diff --git a/src/main/java/org/postgresql/util/ObjectFactory.java b/src/main/java/org/postgresql/util/ObjectFactory.java
+index 055670f..2c500bb 100644
+--- a/src/main/java/org/postgresql/util/ObjectFactory.java
++++ b/src/main/java/org/postgresql/util/ObjectFactory.java
+@@ -36,14 +36,15 @@ public class ObjectFactory {
+    * @throws IllegalAccessException if something goes wrong
+    * @throws InvocationTargetException if something goes wrong
+    */
+-  public static Object instantiate(String classname, Properties info, boolean tryString,
++  public static <T> T instantiate(Class<T> expectedClass, String classname, Properties info,
++      boolean tryString,
+       /* @Nullable */ String stringarg)
+       throws ClassNotFoundException, SecurityException, NoSuchMethodException,
+           IllegalArgumentException, InstantiationException, IllegalAccessException,
+           InvocationTargetException {
+     /* @Nullable */ Object[] args = {info};
+-    Constructor<?> ctor = null;
+-    Class<?> cls = Class.forName(classname);
++    Constructor<? extends T> ctor = null;
++    Class<? extends T> cls = Class.forName(classname).asSubclass(expectedClass);
+     try {
+       ctor = cls.getConstructor(Properties.class);
+     } catch (NoSuchMethodException ignored) {
+diff --git a/src/test/java/org/postgresql/test/util/ObjectFactoryTest.java b/src/test/java/org/postgresql/test/util/ObjectFactoryTest.java
+new file mode 100644
+index 0000000..e0a9d1f
+--- /dev/null
++++ b/src/test/java/org/postgresql/test/util/ObjectFactoryTest.java
+@@ -0,0 +1,106 @@
++/*
++ * Copyright (c) 2022, PostgreSQL Global Development Group
++ * See the LICENSE file in the project root for more information.
++ */
++
++package org.postgresql.test.util;
++
++import static org.junit.jupiter.api.Assertions.assertThrows;
++import static org.junit.jupiter.api.Assertions.assertEquals;
++import static org.junit.jupiter.api.Assertions.assertFalse;
++
++import org.postgresql.PGProperty;
++import org.postgresql.jdbc.SslMode;
++import org.postgresql.test.TestUtil;
++import org.postgresql.util.ObjectFactory;
++import org.postgresql.util.PSQLState;
++
++import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.Assertions;
++import org.opentest4j.MultipleFailuresError;
++
++import java.sql.SQLException;
++import java.util.Properties;
++
++import javax.net.SocketFactory;
++
++public class ObjectFactoryTest {
++  Properties props = new Properties();
++
++  static class BadObject {
++    static boolean wasInstantiated = false;
++
++    BadObject() {
++      wasInstantiated = true;
++      throw new RuntimeException("I should not be instantiated");
++    }
++  }
++
++  private void testInvalidInstantiation(PGProperty prop, PSQLState expectedSqlState) {
++    prop.set(props, BadObject.class.getName());
++
++    BadObject.wasInstantiated = false;
++    SQLException ex = assertThrows(SQLException.class, () -> {
++      TestUtil.openDB(props);
++    });
++
++    try {
++      Assertions.assertAll(
++          () -> assertFalse(BadObject.wasInstantiated, "ObjectFactory should not have "
++              + "instantiated bad object for " + prop),
++          () -> assertEquals(expectedSqlState.getState(), ex.getSQLState(), () -> "#getSQLState()"),
++          () -> {
++            assertThrows(
++                ClassCastException.class,
++                () -> {
++                  throw ex.getCause();
++                },
++                () -> "Wrong class specified for " + prop.name()
++                    + " => ClassCastException is expected in SQLException#getCause()"
++            );
++          }
++      );
++    } catch (MultipleFailuresError e) {
++      // Add the original exception so it is easier to understand the reason for the test to fail
++      e.addSuppressed(ex);
++      throw e;
++    }
++  }
++
++  @Test
++  public void testInvalidSocketFactory() {
++    testInvalidInstantiation(PGProperty.SOCKET_FACTORY, PSQLState.CONNECTION_FAILURE);
++  }
++
++  @Test
++  public void testInvalidSSLFactory() {
++    TestUtil.assumeSslTestsEnabled();
++    // We need at least "require" to trigger SslSockerFactory instantiation
++    PGProperty.SSL_MODE.set(props, SslMode.REQUIRE.value);
++    testInvalidInstantiation(PGProperty.SSL_FACTORY, PSQLState.CONNECTION_FAILURE);
++  }
++
++  @Test
++  public void testInvalidAuthenticationPlugin() {
++    testInvalidInstantiation(PGProperty.AUTHENTICATION_PLUGIN_CLASS_NAME,
++        PSQLState.INVALID_PARAMETER_VALUE);
++  }
++
++  @Test
++  public void testInvalidSslHostnameVerifier() {
++    TestUtil.assumeSslTestsEnabled();
++    // Hostname verification is done at verify-full level only
++    PGProperty.SSL_MODE.set(props, SslMode.VERIFY_FULL.value);
++    PGProperty.SSL_ROOT_CERT.set(props, TestUtil.getSslTestCertPath("goodroot.crt"));
++    testInvalidInstantiation(PGProperty.SSL_HOSTNAME_VERIFIER, PSQLState.CONNECTION_FAILURE);
++  }
++
++  @Test
++  public void testInstantiateInvalidSocketFactory() {
++    Properties props = new Properties();
++    assertThrows(ClassCastException.class, () -> {
++      ObjectFactory.instantiate(SocketFactory.class, BadObject.class.getName(), props,
++          false, null);
++    });
++  }
++}

debian/patches/CVE-2022-26520.patch

+From: Markus Koschany <apo@debian.org>
+Date: Sun, 3 Jul 2022 14:05:39 +0200
+Subject: CVE-2022-26520
+
+Origin: https://github.com/pgjdbc/pgjdbc/commit/f6d47034a4ce292e1a659fa00963f6f713117064
+---
+ README.md                                          |  7 ++-
+ src/main/java/org/postgresql/Driver.java           | 72 +---------------------
+ src/main/java/org/postgresql/PGProperty.java       | 22 ++-----
+ .../org/postgresql/ds/common/BaseDataSource.java   | 20 +++---
+ .../java/org/postgresql/test/jdbc2/DriverTest.java | 67 --------------------
+ .../org/postgresql/test/jdbc2/PGPropertyTest.java  | 10 ---
+ 6 files changed, 24 insertions(+), 174 deletions(-)
+
+diff --git a/README.md b/README.md
+index b70a1ca..3ef8339 100644
+--- a/README.md
++++ b/README.md
+@@ -103,6 +103,11 @@ where:
+  * **database** (Optional) is the database name. Defaults to the same name as the *user name* used in the connection.
+  * **propertyX** (Optional) is one or more option connection properties. For more information see *Connection properties*.
+ 
++### Logging
++PgJDBC uses java.util.logging for logging.
++To configure log levels and control log output destination (e.g. file or console), configure your java.util.logging properties accordingly for the org.postgresql logger.
++Note that the most detailed log levels, "`FINEST`", may include sensitive information such as connection details, query SQL, or command parameters.
++
+ #### Connection Properties
+ In addition to the standard connection parameters the driver supports a number of additional properties which can be used to specify additional driver behaviour specific to PostgreSQL™. These properties may be specified in either the connection URL or an additional Properties object parameter to DriverManager.getConnection.
+ 
+@@ -123,8 +128,6 @@ In addition to the standard connection parameters the driver supports a number o
+ | sslpassword                   | String  | null    | The password for the client's ssl key (ignored if sslpasswordcallback is set) |
+ | sendBufferSize                | Integer | -1      | Socket write buffer size |
+ | receiveBufferSize             | Integer | -1      | Socket read buffer size  |
+-| loggerLevel                   | String  | null    | Logger level of the driver using java.util.logging. Allowed values: OFF, DEBUG or TRACE. |
+-| loggerFile                    | String  | null    | File name output of the Logger, if set, the Logger will use a FileHandler to write to a specified file. If the parameter is not set or the file can't be created the ConsoleHandler will be used instead. |
+ | allowEncodingChanges          | Boolean | false   | Allow for changes in client_encoding |
+ | logUnclosedConnections        | Boolean | false   | When connections that are not explicitly closed are garbage collected, log the stacktrace from the opening of the connection to trace the leak source |
+ | binaryTransferEnable          | String  | ""      | Comma separated list of types to enable binary transfer. Either OID numbers or names |
+diff --git a/src/main/java/org/postgresql/Driver.java b/src/main/java/org/postgresql/Driver.java
+index 678c7a3..11d7e4a 100644
+--- a/src/main/java/org/postgresql/Driver.java
++++ b/src/main/java/org/postgresql/Driver.java
+@@ -9,10 +9,8 @@ import static org.postgresql.util.internal.Nullness.castNonNull;
+ 
+ import org.postgresql.jdbc.PgConnection;
+ import org.postgresql.util.DriverInfo;
+-import org.postgresql.util.ExpressionProperties;
+ import org.postgresql.util.GT;
+ import org.postgresql.util.HostSpec;
+-import org.postgresql.util.LogWriterHandler;
+ import org.postgresql.util.PSQLException;
+ import org.postgresql.util.PSQLState;
+ import org.postgresql.util.SharedTimer;
+@@ -36,11 +34,8 @@ import java.util.Enumeration;
+ import java.util.Properties;
+ import java.util.Set;
+ import java.util.concurrent.TimeUnit;
+-import java.util.logging.Formatter;
+ import java.util.logging.Level;
+ import java.util.logging.Logger;
+-import java.util.logging.SimpleFormatter;
+-import java.util.logging.StreamHandler;
+ 
+ /**
+  * <p>The Java SQL framework allows for multiple database drivers. Each driver should supply a class
+@@ -246,8 +241,6 @@ public class Driver implements java.sql.Driver {
+       return null;
+     }
+     try {
+-      // Setup java.util.logging.Logger using connection properties.
+-      setupLoggerFromProperties(props);
+ 
+       LOGGER.log(Level.FINE, "Connecting with URL: {0}", url);
+ 
+@@ -288,73 +281,14 @@ public class Driver implements java.sql.Driver {
+     }
+   }
+ 
+-  // Used to check if the handler file is the same
+-  private static /* @Nullable */ String loggerHandlerFile;
+ 
+   /**
+-   * <p>Setup java.util.logging.Logger using connection properties.</p>
+-   *
+-   * <p>See {@link PGProperty#LOGGER_FILE} and {@link PGProperty#LOGGER_FILE}</p>
+-   *
++   *  this is an empty method left here for graalvm
++   *  we removed the ability to setup the logger from properties
++   *  due to a security issue
+    * @param props Connection Properties
+    */
+   private void setupLoggerFromProperties(final Properties props) {
+-    final String driverLogLevel = PGProperty.LOGGER_LEVEL.get(props);
+-    if (driverLogLevel == null) {
+-      return; // Don't mess with Logger if not set
+-    }
+-    if ("OFF".equalsIgnoreCase(driverLogLevel)) {
+-      PARENT_LOGGER.setLevel(Level.OFF);
+-      return; // Don't mess with Logger if set to OFF
+-    } else if ("DEBUG".equalsIgnoreCase(driverLogLevel)) {
+-      PARENT_LOGGER.setLevel(Level.FINE);
+-    } else if ("TRACE".equalsIgnoreCase(driverLogLevel)) {
+-      PARENT_LOGGER.setLevel(Level.FINEST);
+-    }
+-
+-    ExpressionProperties exprProps = new ExpressionProperties(props, System.getProperties());
+-    final String driverLogFile = PGProperty.LOGGER_FILE.get(exprProps);
+-    if (driverLogFile != null && driverLogFile.equals(loggerHandlerFile)) {
+-      return; // Same file output, do nothing.
+-    }
+-
+-    for (java.util.logging.Handler handlers : PARENT_LOGGER.getHandlers()) {
+-      // Remove previously set Handlers
+-      handlers.close();
+-      PARENT_LOGGER.removeHandler(handlers);
+-      loggerHandlerFile = null;
+-    }
+-
+-    java.util.logging.Handler handler = null;
+-    if (driverLogFile != null) {
+-      try {
+-        handler = new java.util.logging.FileHandler(driverLogFile);
+-        loggerHandlerFile = driverLogFile;
+-      } catch (Exception ex) {
+-        System.err.println("Cannot enable FileHandler, fallback to ConsoleHandler.");
+-      }
+-    }
+-
+-    Formatter formatter = new SimpleFormatter();
+-
+-    if ( handler == null ) {
+-      if (DriverManager.getLogWriter() != null) {
+-        handler = new LogWriterHandler(DriverManager.getLogWriter());
+-      } else if ( DriverManager.getLogStream() != null) {
+-        handler = new StreamHandler(DriverManager.getLogStream(), formatter);
+-      } else {
+-        handler = new StreamHandler(System.err, formatter);
+-      }
+-    } else {
+-      handler.setFormatter(formatter);
+-    }
+-
+-    Level loggerLevel = PARENT_LOGGER.getLevel();
+-    if (loggerLevel != null) {
+-      handler.setLevel(loggerLevel);
+-    }
+-    PARENT_LOGGER.setUseParentHandlers(false);
+-    PARENT_LOGGER.addHandler(handler);
+   }
+ 
+   /**
+diff --git a/src/main/java/org/postgresql/PGProperty.java b/src/main/java/org/postgresql/PGProperty.java
+index 053adbd..e416d22 100644
+--- a/src/main/java/org/postgresql/PGProperty.java
++++ b/src/main/java/org/postgresql/PGProperty.java
+@@ -252,11 +252,8 @@ public enum PGProperty {
+     "If disabled hosts are connected in the given order. If enabled hosts are chosen randomly from the set of suitable candidates"),
+ 
+   /**
+-   * <p>File name output of the Logger, if set, the Logger will use a
+-   * {@link java.util.logging.FileHandler} to write to a specified file. If the parameter is not set
+-   * or the file can't be created the {@link java.util.logging.ConsoleHandler} will be used instead.</p>
+-   *
+-   * <p>Parameter should be use together with {@link PGProperty#LOGGER_LEVEL}</p>
++   * This property is no longer used by the driver and will be ignored.
++   * Logging is configured via java.util.logging.
+    */
+   LOGGER_FILE(
+     "loggerFile",
+@@ -264,19 +261,8 @@ public enum PGProperty {
+     "File name output of the Logger"),
+ 
+   /**
+-   * <p>Logger level of the driver. Allowed values: {@code OFF}, {@code DEBUG} or {@code TRACE}.</p>
+-   *
+-   * <p>This enable the {@link java.util.logging.Logger} of the driver based on the following mapping
+-   * of levels:</p>
+-   * <ul>
+-   *     <li>FINE -&gt; DEBUG</li>
+-   *     <li>FINEST -&gt; TRACE</li>
+-   * </ul>
+-   *
+-   * <p><b>NOTE:</b> The recommended approach to enable java.util.logging is using a
+-   * {@code logging.properties} configuration file with the property
+-   * {@code -Djava.util.logging.config.file=myfile} or if your are using an application server
+-   * you should use the appropriate logging subsystem.</p>
++   * This property is no longer used by the driver and will be ignored.
++   * Logging is configured via java.util.logging.
+    */
+   LOGGER_LEVEL(
+     "loggerLevel",
+diff --git a/src/main/java/org/postgresql/ds/common/BaseDataSource.java b/src/main/java/org/postgresql/ds/common/BaseDataSource.java
+index 70e601a..39d1c59 100644
+--- a/src/main/java/org/postgresql/ds/common/BaseDataSource.java
++++ b/src/main/java/org/postgresql/ds/common/BaseDataSource.java
+@@ -1176,34 +1176,38 @@ public abstract class BaseDataSource implements CommonDataSource, Referenceable
+   }
+ 
+   /**
+-   * @return Logger Level of the JDBC Driver
+-   * @see PGProperty#LOGGER_LEVEL
++   * This property is no longer used by the driver and will be ignored.
++   * @deprecated Configure via java.util.logging
+    */
++  @Deprecated
+   public /* @Nullable */ String getLoggerLevel() {
+     return PGProperty.LOGGER_LEVEL.get(properties);
+   }
+ 
+   /**
+-   * @param loggerLevel of the JDBC Driver
+-   * @see PGProperty#LOGGER_LEVEL
++   * This property is no longer used by the driver and will be ignored.
++   * @deprecated Configure via java.util.logging
+    */
++  @Deprecated
+   public void setLoggerLevel(/* @Nullable */ String loggerLevel) {
+     PGProperty.LOGGER_LEVEL.set(properties, loggerLevel);
+   }
+ 
+   /**
+-   * @return File output of the Logger.
+-   * @see PGProperty#LOGGER_FILE
++   * This property is no longer used by the driver and will be ignored.
++   * @deprecated Configure via java.util.logging
+    */
++  @Deprecated
+   public /* @Nullable */ String getLoggerFile() {
+     ExpressionProperties exprProps = new ExpressionProperties(properties, System.getProperties());
+     return PGProperty.LOGGER_FILE.get(exprProps);
+   }
+ 
+   /**
+-   * @param loggerFile File output of the Logger.
+-   * @see PGProperty#LOGGER_LEVEL
++   * This property is no longer used by the driver and will be ignored.
++   * @deprecated Configure via java.util.logging
+    */
++  @Deprecated
+   public void setLoggerFile(/* @Nullable */ String loggerFile) {
+     PGProperty.LOGGER_FILE.set(properties, loggerFile);
+   }
+diff --git a/src/test/java/org/postgresql/test/jdbc2/DriverTest.java b/src/test/java/org/postgresql/test/jdbc2/DriverTest.java
+index 56e68c4..01f81ad 100644
+--- a/src/test/java/org/postgresql/test/jdbc2/DriverTest.java
++++ b/src/test/java/org/postgresql/test/jdbc2/DriverTest.java
+@@ -15,13 +15,10 @@ import static org.junit.Assert.fail;
+ import org.postgresql.Driver;
+ import org.postgresql.PGProperty;
+ import org.postgresql.test.TestUtil;
+-import org.postgresql.util.LogWriterHandler;
+-import org.postgresql.util.NullOutputStream;
+ import org.postgresql.util.URLCoder;
+ 
+ import org.junit.Test;
+ 
+-import java.io.PrintWriter;
+ import java.lang.reflect.Method;
+ import java.sql.Connection;
+ import java.sql.DriverManager;
+@@ -29,8 +26,6 @@ import java.sql.SQLException;
+ import java.util.ArrayList;
+ import java.util.Collections;
+ import java.util.Properties;
+-import java.util.logging.Handler;
+-import java.util.logging.Logger;
+ 
+ /*
+  * Tests the dynamically created class org.postgresql.Driver
+@@ -213,68 +208,6 @@ public class DriverTest {
+     fail("Driver has not been found in DriverManager's list but it should be registered");
+   }
+ 
+-  @Test
+-  public void testSetLogWriter() throws Exception {
+-
+-    // this is a dummy to make sure TestUtil is initialized
+-    Connection con = DriverManager.getConnection(TestUtil.getURL(), TestUtil.getUser(), TestUtil.getPassword());
+-    con.close();
+-    String loggerLevel = System.getProperty("loggerLevel");
+-    String loggerFile = System.getProperty("loggerFile");
+-
+-    PrintWriter prevLog = DriverManager.getLogWriter();
+-    try {
+-      PrintWriter printWriter = new PrintWriter(new NullOutputStream(System.err));
+-      DriverManager.setLogWriter(printWriter);
+-      assertEquals(DriverManager.getLogWriter(), printWriter);
+-      System.clearProperty("loggerFile");
+-      System.clearProperty("loggerLevel");
+-      Properties props = new Properties();
+-      props.setProperty("user", TestUtil.getUser());
+-      props.setProperty("password", TestUtil.getPassword());
+-      props.setProperty("loggerLevel", "DEBUG");
+-      con = DriverManager.getConnection(TestUtil.getURL(), props);
+-
+-      Logger logger = Logger.getLogger("org.postgresql");
+-      Handler[] handlers = logger.getHandlers();
+-      assertTrue(handlers[0] instanceof LogWriterHandler );
+-      con.close();
+-    } finally {
+-      DriverManager.setLogWriter(prevLog);
+-      setProperty("loggerLevel", loggerLevel);
+-      setProperty("loggerFile", loggerFile);
+-    }
+-  }
+-
+-  @Test
+-  public void testSetLogStream() throws Exception {
+-    // this is a dummy to make sure TestUtil is initialized
+-    Connection con = DriverManager.getConnection(TestUtil.getURL(), TestUtil.getUser(), TestUtil.getPassword());
+-    con.close();
+-    String loggerLevel = System.getProperty("loggerLevel");
+-    String loggerFile = System.getProperty("loggerFile");
+-
+-    try {
+-      DriverManager.setLogStream(new NullOutputStream(System.err));
+-      System.clearProperty("loggerFile");
+-      System.clearProperty("loggerLevel");
+-      Properties props = new Properties();
+-      props.setProperty("user", TestUtil.getUser());
+-      props.setProperty("password", TestUtil.getPassword());
+-      props.setProperty("loggerLevel", "DEBUG");
+-      con = DriverManager.getConnection(TestUtil.getURL(), props);
+-
+-      Logger logger = Logger.getLogger("org.postgresql");
+-      Handler []handlers = logger.getHandlers();
+-      assertTrue( handlers[0] instanceof LogWriterHandler );
+-      con.close();
+-    } finally {
+-      DriverManager.setLogStream(null);
+-      setProperty("loggerLevel", loggerLevel);
+-      setProperty("loggerFile", loggerFile);
+-    }
+-  }
+-
+   private void setProperty(String key, String value) {
+     if (value == null) {
+       System.clearProperty(key);
+diff --git a/src/test/java/org/postgresql/test/jdbc2/PGPropertyTest.java b/src/test/java/org/postgresql/test/jdbc2/PGPropertyTest.java
+index 544f823..d16c557 100644
+--- a/src/test/java/org/postgresql/test/jdbc2/PGPropertyTest.java
++++ b/src/test/java/org/postgresql/test/jdbc2/PGPropertyTest.java
+@@ -8,7 +8,6 @@ package org.postgresql.test.jdbc2;
+ import static org.junit.Assert.assertEquals;
+ import static org.junit.Assert.assertFalse;
+ import static org.junit.Assert.assertNotNull;
+-import static org.junit.Assert.assertNull;
+ import static org.junit.Assert.assertSame;
+ import static org.junit.Assert.assertTrue;
+ 
+@@ -215,15 +214,6 @@ public class PGPropertyTest {
+     assertFalse(PGProperty.READ_ONLY.isPresent(empty));
+   }
+ 
+-  @Test
+-  public void testNullValue() {
+-    Properties empty = new Properties();
+-    assertNull(PGProperty.LOGGER_LEVEL.getSetString(empty));
+-    Properties withLogging = new Properties();
+-    withLogging.setProperty(PGProperty.LOGGER_LEVEL.getName(), "OFF");
+-    assertNotNull(PGProperty.LOGGER_LEVEL.getSetString(withLogging));
+-  }
+-
+   @Test
+   public void testEncodedUrlValues() {
+     String databaseName = "d&a%ta+base";

debian/patches/series

 02-scram-optional.patch
 missing-test-deps
+CVE-2022-21724.patch
+CVE-2022-26520.patch