PT-2012-2921 · Postgresql+3 · Postgresql+3

Robert Haas · Published 2012-05-21 · Updated 2025-08-14 · CVE-2012-0868

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 8.3.x through 8.3.17 PostgreSQL versions 8.4.x through 8.4.10 PostgreSQL versions 9.0.x through 9.0.6 PostgreSQL versions 9.1.x through 9.1.2

Description The issue allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines. These newlines are inserted into an SQL script used when the database is restored, enabling the execution of arbitrary SQL commands. This is a result of a CRLF injection vulnerability in pg dump.

Recommendations For PostgreSQL versions 8.3.x through 8.3.17, update to version 8.3.18 or later. For PostgreSQL versions 8.4.x through 8.4.10, update to version 8.4.11 or later. For PostgreSQL versions 9.0.x through 9.0.6, update to version 9.0.7 or later. For PostgreSQL versions 9.1.x through 9.1.2, update to version 9.1.3 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CESA-2012_0678

CVE-2012-0868

DSA-2418-1

OPENSUSE-SU-2024:10030-1

OPENSUSE-SU-2024:10256-1

OPENSUSE-SU-2024:10273-1

RHSA-2012:0677

RHSA-2012:0678

RHSA-2012_0677

RHSA-2012_0678

Affected Products

Centos

Postgresql

Red Hat

Suse

References · 79

• https://linux.oracle.com/errata/ELSA-2012-0678.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10030-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0866 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-0868 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2012:026 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0678.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0677.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0868 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2012:027 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10256-1 · Vendor Advisory
• http://debian.org/security/2012/dsa-2418 · Vendor Advisory
• http://postgresql.org/about/news/1377 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0867 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10273-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html · Vendor Advisory