[SPARK-39996] Upgrade postgresql to 42.5.0

• Type: Dependency upgrade
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.4.0
• Fix Version/s: 3.4.0
• Component/s: Build, Tests
• Assignee: Bjørn Jørgensen
• Reporter: Bjørn Jørgensen
• Created: 06/Aug/22 10:44
• Updated: 04/Sep/22 13:25
• Resolved: 04/Sep/22 13:25

Description

Security

• fix: CVE-2022-31197 Fixes SQL generated in PgResultSet.refresh() to escape column identifiers so as to prevent SQL injection.
• Previously, the column names for both key and data columns in the table were copied as-is into the generated
  SQL. This allowed a malicious table with column names that include statement terminator to be parsed and
  executed as multiple separate commands.
• Also adds a new test class ResultSetRefreshTest to verify this change.
• Reported by [Sho Kato](https://github.com/kato-sho)

Release note

Issue Links

• links to: [Github] Pull Request #37762 (bjornjorgensen)