postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresql | Aug 22, 2024 | Nov 13, 2018 |
| Freebsd | — | Upgrade postgresql96-serverUpgrade postgresql94-serverUpgrade postgresql10-serverUpgrade postgresql95-serverUpgrade postgresql93-server | Nov 9, 2018 | Nov 8, 2018 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Dec 3, 2018 | Nov 13, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-plpython | Nov 28, 2019 | Nov 13, 2018 |
| Postgres | — | Upgrade to PostgreSQL version 11.1 | Jan 7, 2019 | Nov 13, 2018 |
| Suse | — | Upgrade postgresql10Upgrade postgresql10-testUpgrade postgresql10-plpythonUpgrade libpq5Upgrade postgresql10-contribUpgrade libecpg6Upgrade postgresql10-pltclUpgrade libecpg6-32bitUpgrade postgresql10-docsUpgrade libpq5-32bitUpgrade postgresql10-serverUpgrade postgresql10-plperlUpgrade postgresql10-devel | Nov 16, 2018 | Nov 8, 2018 |
| Ubuntu | — | Upgrade postgresql-10 | Nov 16, 2018 | Nov 8, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 13, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub