CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresql84-develUpgrade postgresql-contribUpgrade postgresql84-contribUpgrade postgresql84-docsUpgrade postgresql-develUpgrade postgresql-tclUpgrade postgresql84-libsUpgrade postgresql84-plpythonUpgrade postgresql84-serverUpgrade postgresql84-tclUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-docsUpgrade postgresql84-plperlUpgrade postgresql84-pythonUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql84Upgrade postgresql-pltclUpgrade postgresql84-testUpgrade postgresql-pythonUpgrade postgresql-plUpgrade postgresql84-pltclUpgrade postgresql | Dec 1, 2016 | Jul 18, 2012 |
| Freebsd | — | Upgrade postgresql-client | Dec 10, 2025 | Feb 28, 2012 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server. | Oct 30, 2017 | Jul 18, 2012 |
| Oracle_linux | — | Upgrade postgresql84-develUpgrade postgresqlUpgrade postgresql84-testUpgrade postgresql84-contribUpgrade postgresql84-pltclUpgrade postgresql-plperlUpgrade postgresql84-tclUpgrade postgresql84Upgrade postgresql84-plperlUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-tclUpgrade postgresql-docsUpgrade postgresql84-plpythonUpgrade postgresql-pltclUpgrade postgresql-pythonUpgrade postgresql-libsUpgrade postgresql84-serverUpgrade postgresql-plUpgrade postgresql-develUpgrade postgresql-plpythonUpgrade postgresql84-docsUpgrade postgresql84-pythonUpgrade postgresql84-libsUpgrade postgresql-contrib | Oct 16, 2024 | Jul 18, 2012 |
| Postgres | — | Upgrade to PostgreSQL version 9.0.7Upgrade to PostgreSQL version 8.4.11Upgrade to PostgreSQL version 8.3.18Upgrade to PostgreSQL version 9.1.3 | Feb 24, 2013 | Jul 18, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 27, 2012 |
| Suse | — | Upgrade postgresql93-docsUpgrade postgresql10-serverUpgrade postgresql96Upgrade postgresql10-plpythonUpgrade postgresql96-serverUpgrade postgresql94Upgrade postgresql96-contribUpgrade libecpg6Upgrade postgresql94-contribUpgrade postgresql10-plperlUpgrade postgresql94-docsUpgrade postgresql93-contribUpgrade postgresql93-serverUpgrade postgresqlUpgrade postgresql10Upgrade postgresql94-develUpgrade postgresql96-develUpgrade postgresql10-contribUpgrade postgresql10-develUpgrade libpq5Upgrade postgresql-contribUpgrade postgresql94-serverUpgrade postgresql93-develUpgrade postgresql10-docsUpgrade postgresql96-docsUpgrade postgresql-docsUpgrade libpq5-32bitUpgrade postgresql-develUpgrade postgresql10-pltclUpgrade postgresql-serverUpgrade postgresql93 | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-8.4Upgrade postgresql-8.3Upgrade postgresql-9.1 | Nov 8, 2024 | Jul 18, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub