CVE-2018-16850

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 79%
Affected Products (NVD)
VendorProductVersion
postgresqlpostgresql
10.0 ≤
𝑥
< 10.6
postgresqlpostgresql
11.0 ≤
𝑥
< 11.1
redhatenterprise_linux
7.0
redhatenterprise_linux
7.4
redhatenterprise_linux
7.5
redhatenterprise_linux
7.6
canonicalubuntu_linux
18.04
canonicalubuntu_linux
18.10
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
postgresql-10
bionic
Fixed 10.6-0ubuntu0.18.04.1
released
cosmic
Fixed 10.6-0ubuntu0.18.10.1
released
trusty
dne
xenial
dne
postgresql-9.1
bionic
dne
cosmic
dne
trusty
dne
xenial
dne
postgresql-9.3
bionic
dne
cosmic
dne
trusty
not-affected
xenial
dne
postgresql-9.5
bionic
dne
cosmic
dne
trusty
dne
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libecpg6
suse enterprise sap 12 SP3
10.6-1.6.1
fixed
suse enterprise sap 12 SP4
10.6-1.6.1
fixed
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise sap 15
10.6-4.8.1
fixed
suse enterprise sap 15 SP1
10.6-6.25
fixed
suse enterprise server 12 SP3
10.6-1.6.1
fixed
suse enterprise server 12 SP4
10.6-1.6.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
suse enterprise server 15
10.6-4.8.1
fixed
suse enterprise server 15 SP1
10.6-6.25
fixed
libpq5
suse enterprise desktop 15
10.6-4.8.1
fixed
suse enterprise desktop 15 SP1
10.6-6.25
fixed
suse enterprise sap 12 SP3
10.6-1.6.1
fixed
suse enterprise sap 12 SP4
10.6-1.6.1
fixed
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise sap 15
10.6-4.8.1
fixed
suse enterprise sap 15 SP1
10.6-6.25
fixed
suse enterprise server 12 SP3
10.6-1.6.1
fixed
suse enterprise server 12 SP4
10.6-1.6.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
suse enterprise server 15
10.6-4.8.1
fixed
suse enterprise server 15 SP1
10.6-6.25
fixed
libpq5-32bit
suse enterprise sap 12 SP3
10.6-1.6.1
fixed
suse enterprise sap 12 SP4
10.6-1.6.1
fixed
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise server 12 SP3
10.6-1.6.1
fixed
suse enterprise server 12 SP4
10.6-1.6.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
postgresql10
suse enterprise desktop 15
10.6-4.8.1
fixed
suse enterprise desktop 15 SP1
10.6-6.26
fixed
suse enterprise sap 12 SP3
10.6-1.6.1
fixed
suse enterprise sap 12 SP4
10.6-1.6.1
fixed
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise sap 15
10.6-4.8.1
fixed
suse enterprise sap 15 SP1
10.6-6.26
fixed
suse enterprise sap 15 SP3
10.16-8.29.1
fixed
suse enterprise server 12 SP3
10.6-1.6.1
fixed
suse enterprise server 12 SP4
10.6-1.6.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
suse enterprise server 15
10.6-4.8.1
fixed
suse enterprise server 15 SP1
10.6-6.26
fixed
suse enterprise server 15 SP3
10.16-8.29.1
fixed
postgresql10-contrib
suse enterprise sap 12 SP3
10.6-1.6.1
fixed
suse enterprise sap 12 SP4
10.6-1.6.1
fixed
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise sap 15
10.6-4.8.1
fixed
suse enterprise sap 15 SP1
10.6-6.26
fixed
suse enterprise sap 15 SP2
10.12-8.13.10
fixed
suse enterprise sap 15 SP3
10.16-8.29.1
fixed
suse enterprise server 12 SP3
10.6-1.6.1
fixed
suse enterprise server 12 SP4
10.6-1.6.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
suse enterprise server 15
10.6-4.8.1
fixed
suse enterprise server 15 SP1
10.6-6.26
fixed
suse enterprise server 15 SP2
10.12-8.13.10
fixed
suse enterprise server 15 SP3
10.16-8.29.1
fixed
postgresql10-devel
suse enterprise sap 15
10.6-4.8.1
fixed
suse enterprise sap 15 SP1
10.6-6.25
fixed
suse enterprise sap 15 SP2
10.12-8.13.9
fixed
suse enterprise sap 15 SP3
10.16-8.29.1
fixed
suse enterprise server 15
10.6-4.8.1
fixed
suse enterprise server 15 SP1
10.6-6.25
fixed
suse enterprise server 15 SP2
10.12-8.13.9
fixed
suse enterprise server 15 SP3
10.16-8.29.1
fixed
postgresql10-docs
suse enterprise sap 12 SP3
10.6-1.6.1
fixed
suse enterprise sap 12 SP4
10.6-1.6.1
fixed
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise sap 15
10.6-4.8.1
fixed
suse enterprise sap 15 SP1
10.6-6.26
fixed
suse enterprise sap 15 SP2
10.12-8.13.10
fixed
suse enterprise server 12 SP3
10.6-1.6.1
fixed
suse enterprise server 12 SP4
10.6-1.6.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
suse enterprise server 15
10.6-4.8.1
fixed
suse enterprise server 15 SP1
10.6-6.26
fixed
suse enterprise server 15 SP2
10.12-8.13.10
fixed
postgresql10-plperl
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise sap 15
10.6-4.8.1
fixed
suse enterprise sap 15 SP1
10.6-6.26
fixed
suse enterprise sap 15 SP2
10.12-8.13.10
fixed
suse enterprise sap 15 SP3
10.16-8.29.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
suse enterprise server 15
10.6-4.8.1
fixed
suse enterprise server 15 SP1
10.6-6.26
fixed
suse enterprise server 15 SP2
10.12-8.13.10
fixed
suse enterprise server 15 SP3
10.16-8.29.1
fixed
postgresql10-plpython
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise sap 15
10.6-4.8.1
fixed
suse enterprise sap 15 SP1
10.6-6.26
fixed
suse enterprise sap 15 SP2
10.12-8.13.10
fixed
suse enterprise sap 15 SP3
10.16-8.29.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
suse enterprise server 15
10.6-4.8.1
fixed
suse enterprise server 15 SP1
10.6-6.26
fixed
suse enterprise server 15 SP2
10.12-8.13.10
fixed
suse enterprise server 15 SP3
10.16-8.29.1
fixed
postgresql10-pltcl
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise sap 15
10.6-4.8.1
fixed
suse enterprise sap 15 SP1
10.6-6.26
fixed
suse enterprise sap 15 SP2
10.12-8.13.10
fixed
suse enterprise sap 15 SP3
10.16-8.29.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
suse enterprise server 15
10.6-4.8.1
fixed
suse enterprise server 15 SP1
10.6-6.26
fixed
suse enterprise server 15 SP2
10.12-8.13.10
fixed
suse enterprise server 15 SP3
10.16-8.29.1
fixed
postgresql10-server
suse enterprise sap 12 SP3
10.6-1.6.1
fixed
suse enterprise sap 12 SP4
10.6-1.6.1
fixed
suse enterprise sap 12 SP5
10.10-1.15.1
fixed
suse enterprise sap 15
10.6-4.8.1
fixed
suse enterprise sap 15 SP1
10.6-6.26
fixed
suse enterprise sap 15 SP2
10.12-8.13.10
fixed
suse enterprise sap 15 SP3
10.16-8.29.1
fixed
suse enterprise server 12 SP3
10.6-1.6.1
fixed
suse enterprise server 12 SP4
10.6-1.6.1
fixed
suse enterprise server 12 SP5
10.10-1.15.1
fixed
suse enterprise server 15
10.6-4.8.1
fixed
suse enterprise server 15 SP1
10.6-6.26
fixed
suse enterprise server 15 SP2
10.12-8.13.10
fixed
suse enterprise server 15 SP3
10.16-8.29.1
fixed
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/105923
http://www.securitytracker.com/id/1042144
https://access.redhat.com/errata/RHSA-2018:3757
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16850
https://security.gentoo.org/glsa/201811-24
https://usn.ubuntu.com/3818-1/
https://www.postgresql.org/about/news/1905/
http://www.securityfocus.com/bid/105923
http://www.securitytracker.com/id/1042144
https://access.redhat.com/errata/RHSA-2018:3757
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16850
https://security.gentoo.org/glsa/201811-24
https://usn.ubuntu.com/3818-1/
https://www.postgresql.org/about/news/1905/