CVE-2018-16850

State: PUBLISHED · Published: 2018-11-13 · Updated: 2024-08-05 · Assigner: redhat

Description

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.

CWE

CWE-89 — CWE-89

Affected

The PostgreSQL Project / postgresql — v=11.1 [affected]; v=10.6 [affected]

CVSS

3.0 score=8 severity=HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://usn.ubuntu.com/3818-1/ vendor-advisory, x_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:3757 vendor-advisory, x_refsource_REDHAT
https://www.postgresql.org/about/news/1905/ x_refsource_CONFIRM
http://www.securitytracker.com/id/1042144 vdb-entry, x_refsource_SECTRACK
https://security.gentoo.org/glsa/201811-24 vendor-advisory, x_refsource_GENTOO
http://www.securityfocus.com/bid/105923 vdb-entry, x_refsource_BID
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16850 x_refsource_CONFIRM

Source

cvelistV5-main/cves/2018/16xxx/CVE-2018-16850.json