A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Base Score: 8.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql14Upgrade postgresql15 | Aug 22, 2024 | Aug 9, 2018 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-plperlUpgrade postgresql-debuginfoUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-libs | Apr 27, 2020 | Aug 9, 2018 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql92Upgrade postgresql96Upgrade postgresql94Upgrade postgresql95Upgrade postgresql93 | Sep 7, 2018 | Aug 9, 2018 |
| Centos_linux | — | Upgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-debuginfoUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-upgradeUpgrade postgresql-plperlUpgrade postgresql-develUpgrade postgresql-libsUpgrade postgresql-pltclUpgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-docs | Aug 30, 2018 | Aug 9, 2018 |
| Debian | — | Upgrade postgresql-9.6 | Aug 12, 2018 | Aug 9, 2018 |
| Freebsd | — | Upgrade postgresql94-serverUpgrade postgresql10-serverUpgrade postgresql93-serverUpgrade postgresql96-serverUpgrade postgresql95-server | Aug 11, 2018 | Aug 10, 2018 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 31, 2018 | Aug 9, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-libs | Sep 27, 2018 | Aug 9, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-devel | Sep 27, 2018 | Aug 9, 2018 |
| Oracle_linux | — | Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresql-plperl | Jul 21, 2020 | Aug 9, 2018 |
| Postgres | — | Upgrade to PostgreSQL version 10.5 | Jan 7, 2019 | Aug 9, 2018 |
| Redhat_linux | — | Upgrade postgresql-debuginfoUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgresql-devel | Aug 24, 2018 | Aug 9, 2018 |
| Suse | — | Upgrade postgresql-plperlUpgrade postgresql10-serverUpgrade postgresql94-contribUpgrade postgresqlUpgrade postgresql-serverUpgrade libpq5-32bitUpgrade postgresql12-llvmjitUpgrade libpq5Upgrade postgresql-pltclUpgrade postgresql12-docsUpgrade postgresql96-testUpgrade postgresql10-testUpgrade postgresql-testUpgrade postgresql94-docsUpgrade postgresql12-contribUpgrade postgresql10Upgrade libecpg6-32bitUpgrade postgresql12-serverUpgrade postgresql10-contribUpgrade postgresql96-serverUpgrade postgresql12Upgrade postgresql94-develUpgrade postgresql10-pltclUpgrade postgresql96-develUpgrade postgresql-docsUpgrade postgresql10-develUpgrade postgresql96-contribUpgrade postgresql-develUpgrade postgresql12-server-develUpgrade postgresql-plpythonUpgrade postgresql12-plpythonUpgrade libecpg6Upgrade postgresql94-serverUpgrade postgresql10-docsUpgrade postgresql96-plpythonUpgrade postgresql96Upgrade postgresql96-plperlUpgrade postgresql94Upgrade postgresql12-develUpgrade postgresql12-pltclUpgrade postgresql-server-develUpgrade postgresql-llvmjitUpgrade postgresql12-testUpgrade postgresql12-plperlUpgrade postgresql96-pltclUpgrade postgresql10-plperlUpgrade postgresql-contribUpgrade postgresql96-docsUpgrade postgresql10-plpython | Sep 5, 2018 | Aug 9, 2018 |
| Ubuntu | — | Upgrade postgresql-9.3Upgrade postgresql-9.5Upgrade postgresql-10 | Aug 23, 2018 | Aug 9, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub