Yasuo Ohgaki

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions prior to 8.1.4 PostgreSQL versions prior to 8.0.8 PostgreSQL versions prior to 7.4.13 PostgreSQL versions prior to 7.3.15 **Description** The issue allows context-dependent attackers to bypass SQL injection protection methods in applications via invalid encodings of multibyte characters. An attacker able to submit crafted strings to an application that will embed those strings in SQL commands can use invalidly-encoded multibyte characters to bypass standard string-escaping methods, resulting in possible SQL injection. **Recommendations** For versions prior to 8.1.4, update to version 8.1.4 or later. For versions prior to 8.0.8, update to version 8.0.8 or later. For versions prior to 7.4.13, update to version 7.4.13 or later. For versions prior to 7.3.15, update to version 7.3.15 or later.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions 8.1.x through 8.1.3 PostgreSQL versions 8.0.x through 8.0.7 PostgreSQL versions 7.4.x through 7.4.12 PostgreSQL versions 7.3.x through 7.3.14 PostgreSQL versions prior to 7.3.15 **Description** The issue allows context-dependent attackers to bypass SQL injection protection methods in applications that use multibyte encodings, such as SJIS, BIG5, GBK, GB18030, and UHC. This is due to the inability of clients that do not understand multibyte encodings to handle the "" (backslash) byte 0x5c correctly when it is the trailing byte of a multibyte character. The practice of escaping ASCII single quote "'" by turning it into "'" is unsafe when operating in these multibyte encodings. **Recommendations** For PostgreSQL versions 8.1.x through 8.1.3, update to version 8.1.4 or later. For PostgreSQL versions 8.0.x through 8.0.7, update to version 8.0.8 or later. For PostgreSQL versions 7.4.x through 7.4.12, update to version 7.4.13 or later. For PostgreSQL versions 7.3.x through 7.3.14, update to version 7.3.15 or later. For PostgreSQL versions prior to 7.3.15, update to version 7.3.15 or later.