PT-2012-3386 · Postgresql · Postgresql Jdbc Driver

Steffen Dettmer · Publicado 2012-10-06 · Atualizado 2023-02-13 · CVE-2012-1618

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL JDBC driver versions prior to 8.2

Description The issue arises from an interaction error in the PostgreSQL JDBC driver when used with a PostgreSQL server that has the "standard conforming strings" option enabled. This error allows remote attackers to perform SQL injection attacks due to the improper escaping of unspecified JDBC statement parameters.

Recommendations For versions prior to 8.2, update to version 8.2 or later to resolve the issue. As a temporary workaround, consider disabling the use of unspecified JDBC statement parameters until a patch is available. Restrict access to sensitive database operations to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2012-1618

GHSA-H86W-M5RM-XR33

Produtos afetados

Postgresql Jdbc Driver

Referências · 15

• https://github.com/pgjdbc/pgjdbc · Nota
• http://openwall.com/lists/oss-security/2012/03/30/9 · Nota
• http://openwall.com/lists/oss-security/2012/04/04/11 · Nota
• http://osvdb.org/80641 · Nota
• http://openwall.com/lists/oss-security/2012/03/30/8 · Nota
• http://openwall.com/lists/oss-security/2012/04/04/5 · Nota
• http://lists.opensuse.org/opensuse-security/2012-03/msg00024.html · Nota
• http://openwall.com/lists/oss-security/2012/03/31/1 · Nota
• http://openwall.com/lists/oss-security/2012/04/02/4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1618 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2012-03/0126.html · Nota
• http://openwall.com/lists/oss-security/2012/04/04/9 · Nota
• https://bugzilla.novell.com/show_bug.cgi?id=754273 · Nota
• https://osv.dev/vulnerability/GHSA-h86w-m5rm-xr33 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/04/04/4 · Nota