Security Advisory - Command Injection Vulnerability in the GaussDB

The GaussDB has a command injection vulnerability. Due to the lack of input validation on some parameters, an attacker with low privilege may inject some specific command to modify database files, causing database service abnormal. (Vulnerability ID: HWPSIRT-2017-05043)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2013-1899.

Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170531-02-gaussdb-en