The vulnerability of the pg_upgrade and pg_dump utilities in the PostgreSQL database management system allows a hacker to execute arbitrary SQL commands.

🗓️ 29 Mar 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

PostgreSQL pg_upgrade and pg_dump vulnerabilities allow remote arbitrary SQL execution due to unprotected query structure.

Reporter	Title	Published	Views	Family All 74
ALT Linux	Security fix for the ALT Linux 8 package postgresql10 version 10.6-alt0.M80P.1	11 Dec 201800:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 8 package postgresql11 version 11.1-alt0.M80P.1	11 Dec 201800:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 8 package postgresql11-1C version 10.6-alt0.M80P.1	8 Nov 201800:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package postgresql12 version 11.1-alt1	8 Nov 201800:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 8 package postgresql12 version 11.1-alt0.M80P.1	8 Nov 201800:00	–	altlinux
FreeBSD	PostgreSQL -- SQL injection in pg_upgrade and pg_dump	8 Nov 201800:00	–	freebsd
AlpineLinux	CVE-2018-16850	13 Nov 201815:00	–	alpinelinux
Broadcom	CVE-2018-16850 - SQL injection in pg_upgrade and pg_dump, via CREATE TRIGGER ... REFERENCING.	19 May 202300:00	–	broadcom
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities fixed in IBM Security Access Manager Appliance	21 Jun 201920:05	–	ibm
CNVD	PostgreSQL 'pg_upgrade' and 'pg_dump' Functions SQL Injection Vulnerability	15 Nov 201800:00	–	cnvd

Vulners

Node

postgresql postgresqlRange9.3.0–9.3.25

OR

postgresql postgresqlRange9.4.0–9.4.20

OR

postgresql postgresqlRange9.5.0–9.5.15

OR

postgresql postgresqlRange9.6.0–9.6.11

OR

postgresql postgresqlRange10.0–10.6

OR

postgresql postgresqlRange11.0–11.1

OR

postgres_professional postgres_pro_certifiedRange<11.11.1

Source	Link
securityfocus	www.securityfocus.com/bid/105923
securitytracker	www.securitytracker.com/id/1042144
access	www.access.redhat.com/errata/RHSA-2018:3757
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
security	www.security.gentoo.org/glsa/201811-24
usn	www.usn.ubuntu.com/3818-1/
postgresql	www.postgresql.org/about/news/1905/
postgrespro	www.postgrespro.ru/products/postgrespro/certified
web	www.web.nvd.nist.gov/view/vuln/detail

11 Aug 2023 00:00Current

7.9High risk

Vulners AI Score7.9

CVSS 27.5

CVSS 39.8

EPSS0.0125

PostgreSQL pg_upgrade pg_dump remote execution structured query language query structure arbitrary commands