CVE-2012-1618

06.10.2012, 22:55

Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks.  NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.5 UNKNOWN	NETWORK	LOW		AV:N/AC:L/Au:N/C:P/I:P/A:P
redhat	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 78%

Vendor	Product	Version
postgresql	postgresql	9.1
postgresql	postgresql_jdbc_driver	8.1

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libpgjava

bullseye (security)	42.2.15-1+deb11u1 fixed
bullseye	42.2.15-1+deb11u1 fixed
bookworm	42.5.4-1 fixed
sid	42.7.3-1 fixed
trixie	42.7.3-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

libpgjava

oneiric	not-affected
natty	not-affected
maverick	not-affected
lucid	not-affected
hardy	ignored

References

http://archives.neohapsis.com/archives/bugtraq/2012-03/0126.html

http://lists.opensuse.org/opensuse-security/2012-03/msg00024.html

http://www.openwall.com/lists/oss-security/2012/03/30/8

http://www.openwall.com/lists/oss-security/2012/03/30/9

http://www.openwall.com/lists/oss-security/2012/03/31/1

http://www.openwall.com/lists/oss-security/2012/04/02/4

http://www.openwall.com/lists/oss-security/2012/04/04/11

http://www.openwall.com/lists/oss-security/2012/04/04/4

http://www.openwall.com/lists/oss-security/2012/04/04/5

http://www.openwall.com/lists/oss-security/2012/04/04/9

http://www.osvdb.org/80641

https://bugzilla.novell.com/show_bug.cgi?id=754273

http://archives.neohapsis.com/archives/bugtraq/2012-03/0126.html

http://lists.opensuse.org/opensuse-security/2012-03/msg00024.html

http://www.openwall.com/lists/oss-security/2012/03/30/8

http://www.openwall.com/lists/oss-security/2012/03/30/9

http://www.openwall.com/lists/oss-security/2012/03/31/1

http://www.openwall.com/lists/oss-security/2012/04/02/4

http://www.openwall.com/lists/oss-security/2012/04/04/11

http://www.openwall.com/lists/oss-security/2012/04/04/4

http://www.openwall.com/lists/oss-security/2012/04/04/5

http://www.openwall.com/lists/oss-security/2012/04/04/9

http://www.osvdb.org/80641

https://bugzilla.novell.com/show_bug.cgi?id=754273