ISOMAN

CVE

CVE-2018-16850

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.

Severity
CRITICAL
CVSS
9.8
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource

References

  1. http://www.securityfocus.com/bid/105923
  2. http://www.securitytracker.com/id/1042144
  3. https://access.redhat.com/errata/RHSA-2018:3757
  4. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16850
  5. https://security.gentoo.org/glsa/201811-24
  6. https://usn.ubuntu.com/3818-1/
  7. https://www.postgresql.org/about/news/1905/
  8. http://www.securityfocus.com/bid/105923
  9. http://www.securitytracker.com/id/1042144
  10. https://access.redhat.com/errata/RHSA-2018:3757
  11. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16850
  12. https://security.gentoo.org/glsa/201811-24
  13. https://usn.ubuntu.com/3818-1/
  14. https://www.postgresql.org/about/news/1905/