Dependency org.postgresql:postgresql, leading to CVE problem

[CVEDetect]

Hi, In /postgis-jts，there is a dependency org.postgresql:postgresql:42.2.23 that calls the risk method.

CVE-2022-26520
The scope of this CVE affected version is [42.1.0,42.3.3)

After further analysis, in this project, the main Api called is org.postgresql.Driver: connect(java.lang.String,java.util.Properties)Ljava.sql.Connection;

Risk method repair link : GitHub

CVE Bug Invocation Path--

Path Length : 2

CVE Bug Invocation Path : 
org.h2gis.postgis_jts.JtsWrapper: connect(java.lang.String,java.util.Properties)Ljava.sql.Connection; /home/hjf/.m2/repository/com/h2database/h2/2.1.214/h2-2.1.214.jar
org.postgresql.Driver: connect(java.lang.String,java.util.Properties)Ljava.sql.Connection;

CVE-2022-21724
The scope of this CVE affected version is [9.4.1208,42.2.25) [42.3.0,42.3.2)

After further analysis, in this project, the main Api called is org.postgresql.core.SocketFactoryFactory: getSocketFactory(java.util.Properties)Ljavax.net.SocketFactory

Risk method repair link : GitHub

CVE Bug Invocation Path--

Path Length : 7

CVE Bug Invocation Path : 
org.h2gis.postgis_jts.JtsWrapper: connect(java.lang.String,java.util.Properties)Ljava.sql.Connection; .m2/repository/com/h2database/h2/2.1.214/h2-2.1.214.jar
org.postgresql.Driver: connect(java.lang.String,java.util.Properties)Ljava.sql.Connection; .m2/repository/com/h2database/h2/2.1.214/h2-2.1.214.jar
org.postgresql.Driver: makeConnection(java.lang.String,java.util.Properties)Ljava.sql.Connection; .m2/repository/com/h2database/h2/2.1.214/h2-2.1.214.jar
org.postgresql.jdbc.PgConnection: init(org.postgresql.util.HostSpec[],java.lang.String,java.lang.String,java.util.Properties,java.lang.String)V .m2/repository/org/postgresql/postgresql/42.2.23/postgresql-42.2.23.jar
org.postgresql.core.ConnectionFactory: openConnection(org.postgresql.util.HostSpec[],java.lang.String,java.lang.String,java.util.Properties)Lorg.postgresql.core.QueryExecutor; .m2/repository/org/postgresql/postgresql/42.2.23/postgresql-42.2.23.jar
org.postgresql.core.v3.ConnectionFactoryImpl: openConnectionImpl(org.postgresql.util.HostSpec[],java.lang.String,java.lang.String,java.util.Properties)Lorg.postgresql.core.QueryExecutor;.m2/repository/org/postgresql/postgresql/42.2.23/postgresql-42.2.23.jar
org.postgresql.core.SocketFactoryFactory: getSocketFactory(java.util.Properties)Ljavax.net.SocketFactory;

Dependency tree--

[INFO] org.orbisgis:postgis-jts:bundle:2.2.1-SNAPSHOT
[INFO] +- com.h2database:h2:jar:2.1.214:compile
[INFO] +- net.postgis:postgis-jdbc:jar:2021.1.0:compile
[INFO] |  +- net.postgis:postgis-geometry:jar:2021.1.0:compile
[INFO] |  +- org.postgresql:postgresql:jar:42.2.23:compile
[INFO] |  |  \- org.checkerframework:checker-qual:jar:3.5.0:runtime
[INFO] |  \- org.slf4j:slf4j-api:jar:1.7.36:compile
[INFO] +- org.locationtech.jts:jts-core:jar:1.19.0:compile
[INFO] +- org.junit.jupiter:junit-jupiter-api:jar:5.9.2:test
[INFO] |  +- org.opentest4j:opentest4j:jar:1.2.0:test
[INFO] |  +- org.junit.platform:junit-platform-commons:jar:1.9.2:test
[INFO] |  \- org.apiguardian:apiguardian-api:jar:1.1.2:test
[INFO] \- org.junit.jupiter:junit-jupiter-engine:jar:5.9.2:test
[INFO]    \- org.junit.platform:junit-platform-engine:jar:1.9.2:test

Suggested solutions:

Update dependency version

Thank you very much.