SQL injection in PostgreSQL - CVE-2012-0868

Vulnerability identifier: #VU43840

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2012-0868

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.

PostgreSQL
Gentoo Linux
Anolis OS
openEuler
IBM Observability with Instana
postgres-decoderbufs
pgaudit
pg_repack
dev-db/postgresql-server
postgresql-plpython3
postgresql-server-devel
postgresql-static
postgresql-test
postgresql-upgrade
postgresql-upgrade-devel
postgresql-test-rpm-macros
postgresql-server
postgresql-pltcl
postgresql-plperl
postgresql-docs
postgresql-contrib
postgresql
postgresql-debugsource
postgresql-private-libs
postgresql-private-devel
postgresql-llvmjit
postgresql-debuginfo
libpq-devel
libpq-debugsource
libpq-debuginfo
libpq

Install update from vendor's website.

IBM Observability with Instana - update to 1.0.309
postgres-decoderbufs - update to 0.10.0-2
pgaudit - update to 1.4.0-7
pg_repack - update to 1.4.6-3
dev-db/postgresql-server - update to 9.1.5
postgresql-plpython3 - addressed in versions 12.22-5.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-server-devel - addressed in versions 12.22-5.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-static - addressed in versions 12.22-5.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-test - addressed in versions 12.22-5.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-upgrade - addressed in versions 12.22-5.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-upgrade-devel - addressed in versions 12.22-5.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-test-rpm-macros - addressed in versions 12.22-5.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-server - addressed in versions 12.22-5.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-pltcl - addressed in versions 12.22-5.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-plperl - addressed in versions 12.22-5.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-docs - addressed in versions 12.22-5.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql-contrib - addressed in versions 12.22-5.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql - addressed in versions 12.22-5.0.1, 13.22-1.0.1, 15.14-1, 15.14-1.0.1
postgresql - addressed in versions 13.22-1, 15.14-1
postgresql-debugsource - addressed in versions 13.22-1, 15.14-1
postgresql-contrib - addressed in versions 13.22-1, 15.14-1
postgresql-server-devel - addressed in versions 13.22-1, 15.14-1
postgresql-server - addressed in versions 13.22-1, 15.14-1
postgresql-private-libs - addressed in versions 13.22-1, 15.14-1
postgresql-private-devel - addressed in versions 13.22-1, 15.14-1
postgresql-pltcl - addressed in versions 13.22-1, 15.14-1
postgresql-plpython3 - addressed in versions 13.22-1, 15.14-1
postgresql-plperl - addressed in versions 13.22-1, 15.14-1
postgresql-llvmjit - addressed in versions 13.22-1, 15.14-1
postgresql-docs - addressed in versions 13.22-1, 15.14-1
postgresql-debuginfo - addressed in versions 13.22-1, 15.14-1
libpq-devel - addressed in versions 13.22-1, 15.14-1
libpq-debugsource - addressed in versions 13.22-1, 15.14-1
libpq-debuginfo - addressed in versions 13.22-1, 15.14-1
libpq - addressed in versions 13.22-1, 15.14-1
postgresql-test-rpm-macros - addressed in versions 13.22-1, 15.14-1
postgresql-test - addressed in versions 13.22-1, 15.14-1
postgresql-static - addressed in versions 13.22-1, 15.14-1
postgresql-private-libs - addressed in versions 15.14-1, 15.14-1.0.1
postgresql-private-devel - addressed in versions 15.14-1, 15.14-1.0.1

• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
• http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html
• http://rhn.redhat.com/errata/RHSA-2012-0677.html
• http://rhn.redhat.com/errata/RHSA-2012-0678.html
• http://secunia.com/advisories/49272
• http://secunia.com/advisories/49273
• http://www.debian.org/security/2012/dsa-2418
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:026
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:027
• http://www.postgresql.org/about/news/1377/
• http://www.postgresql.org/docs/8.3/static/release-8-3-18.html
• http://www.postgresql.org/docs/8.4/static/release-8-4-11.html
• http://www.postgresql.org/docs/9.0/static/release-9-0-7.html
• http://www.postgresql.org/docs/9.1/static/release-9-1-3.html

• Multiple vulnerabilities in PostgreSQL
• Gentoo update for PostgreSQL
• Anolis OS update for postgresql:15 module
• Anolis OS update for postgresql:13 module
• Anolis OS update for postgresql:12 module
• openEuler 24.03 LTS SP2 update for postgresql
• openEuler 24.03 LTS SP1 update for postgresql
• openEuler 22.03 LTS SP4 update for postgresql
• openEuler 22.03 LTS SP3 update for postgresql
• openEuler 24.03 LTS SP2 update for libpq
• openEuler 24.03 LTS SP1 update for libpq
• openEuler 22.03 LTS SP4 update for libpq
• openEuler 22.03 LTS SP3 update for libpq
• openEuler 24.03 LTS update for libpq
• openEuler 24.03 LTS update for postgresql
• Anolis OS update for postgresql
• Multiple vulnerabilities in IBM Observability with Instana