p PatchFirst

CVE-2018-10925

CVE-2018-10925

This page contains facts from public vulnerability sources. Check the original advisory before updating.

It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could exploit this to update other columns in the same table.

CVSS 7.1 · High · EPSS 2.2% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • postgresql

    Versions
    • 10.5: Affected
    • 9.6.10: Affected
    • 9.5.14: Affected
    • 9.4.19: Affected
    • 9.3.24: Affected

    No fix published

  • postgresql-9.5 Ubuntu:16.04:LTS

    Versions
    • 9.5.0-1
    • 9.5.0-2
    • 9.5.0-3
    • 9.5.1-1
    • 9.5.2-1
    • 9.5.3-0ubuntu0.16.04
    • 9.5.4-0ubuntu0.16.04
    • 9.5.5-0ubuntu0.16.04
    • 9.5.6-0ubuntu0.16.04
    • 9.5.7-0ubuntu0.16.04
    • 9.5.8-0ubuntu0.16.04.1
    • 9.5.9-0ubuntu0.16.04
    • 9.5.10-0ubuntu0.16.04
    • 9.5.11-0ubuntu0.16.04
    • 9.5.12-0ubuntu0.16.04
    • 9.5.13-0ubuntu0.16.04
    Affected ranges
    • ECOSYSTEM: < 9.5.14-0ubuntu0.16.04

    Update to 9.5.14-0ubuntu0.16.04

  • postgresql-10 Ubuntu:18.04:LTS

    Versions
    • 10.1-1
    • 10.1-2
    • 10.2-1
    • 10.3-1
    • 10.4-0ubuntu0.18.04
    Affected ranges
    • ECOSYSTEM: < 10.5-0ubuntu0.18.04

    Update to 10.5-0ubuntu0.18.04

Original sources

Check your server →