p PatchFirst

CVE-2018-16850

CVE-2018-16850

This page contains facts from public vulnerability sources. Check the original advisory before updating.

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.

CVSS 8.0 · High · EPSS 5.1% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • postgresql

    Versions
    • 11.1: Affected
    • 10.6: Affected

    No fix published

  • postgresql-10 Ubuntu:18.04:LTS

    Versions
    • 10.1-1
    • 10.1-2
    • 10.2-1
    • 10.3-1
    • 10.4-0ubuntu0.18.04
    • 10.5-0ubuntu0.18.04
    Affected ranges
    • ECOSYSTEM: < 10.6-0ubuntu0.18.04.1

    Update to 10.6-0ubuntu0.18.04.1

Original sources

Check your server →