PT-2012-3386 · Postgresql · Postgresql Jdbc Driver

Steffen Dettmer · Published 2012-10-06 · Updated 2023-02-13 · CVE-2012-1618

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL JDBC driver versions prior to 8.2

Description The issue arises from an interaction error in the PostgreSQL JDBC driver when used with a PostgreSQL server that has the "standard conforming strings" option enabled. This error allows remote attackers to perform SQL injection attacks due to the improper escaping of unspecified JDBC statement parameters.

Recommendations For versions prior to 8.2, update to version 8.2 or later to resolve the issue. As a temporary workaround, consider disabling the use of unspecified JDBC statement parameters until a patch is available. Restrict access to sensitive database operations to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2012-1618

GHSA-H86W-M5RM-XR33

Affected Products

Postgresql Jdbc Driver

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2012-1618 · Security Note
• https://osv.dev/vulnerability/GHSA-h86w-m5rm-xr33 · Vendor Advisory
• https://github.com/pgjdbc/pgjdbc · Note
• http://openwall.com/lists/oss-security/2012/03/30/9 · Note
• http://openwall.com/lists/oss-security/2012/04/04/11 · Note
• http://osvdb.org/80641 · Note
• http://openwall.com/lists/oss-security/2012/03/30/8 · Note
• http://openwall.com/lists/oss-security/2012/04/04/5 · Note
• http://lists.opensuse.org/opensuse-security/2012-03/msg00024.html · Note
• http://openwall.com/lists/oss-security/2012/03/31/1 · Note
• http://openwall.com/lists/oss-security/2012/04/02/4 · Note
• http://archives.neohapsis.com/archives/bugtraq/2012-03/0126.html · Note
• http://openwall.com/lists/oss-security/2012/04/04/9 · Note
• https://bugzilla.novell.com/show_bug.cgi?id=754273 · Note
• http://openwall.com/lists/oss-security/2012/04/04/4 · Note