CVE-2021-3515: Improper Neutralization of Special Elements used in a Command

A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. An attacker with CREATEDB privileges on a PostgreSQL server can craft a database name that allows execution of shell commands as the postgresql user when calling pglogical.createsubscription...

pglogical -- shell command injection in pglogical.create_subscription()

2ndQuadrant reports: Fix pgdump/pgrestore execution CVE-2021-3515 Correctly escape the connection string for both pgdump and pgrestore so that exotic database and user names are handled correctly. Reported by Pedro Gallegos...

PT-2021-4271 · Pglogical · Pglogical

Name of the Vulnerable Software and Affected Versions: pglogical versions before 2.3.4 pglogical versions before 3.6.26 Description: The issue is related to a lack of input data sanitization in the pglogical system, which can be exploited to gain access to confidential data, compromise data...

PostgreSQL 操作系统命令注入漏洞

PostgreSQL is a free object-relational database management system from the Postgresql organization. The system supports most SQL standards and provides many other features such as foreign keys, triggers, views, etc. A security vulnerability exists in PostgreSQL, which stems from the fact that a...