The PostgreSQL Global Development Group postgresql

CVE-2018-1058

HIGH 8.8

At a glance

Source: NVD
EPSS: EPSS 13.10 % · percentile 96 (2026-11-01)
State: PUBLISHED
Published: 2018-03-02 15:00 UTC
Updated: 2024-09-17 03:22 UTC
Assigner: redhat
NVD status: Modified

Search on…

Description

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.

Weaknesses (CWE)

CWE-20 — Improper Input Validation

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2018-11711
GCVE · GCVE-0-2018-1058

Affected configurations (NVD CPE)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 9.3 < 9.3.22
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 9.4 < 9.4.17
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 9.5 < 9.5.12
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 9.6 < 9.6.8
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 10.0 < 10.3
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*

Affected products

Product	Versions
The PostgreSQL Global Development Group · postgresql	affected 9.3 - 10

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ The PostgreSQL Global Development Group postgresql