PT-2016-3442 · Postgresql · Postgresql

Adam Mariš · Published 2016-09-21 · Updated 2023-01-19 · CVE-2016-7048

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 9.3.15 PostgreSQL versions 9.4.x prior to 9.4.10 PostgreSQL versions 9.5.x prior to 9.5.5

Description The issue is related to the interactive installer in PostgreSQL, which might allow remote attackers to execute arbitrary code. This is due to the use of HTTP to download software, potentially allowing the execution of arbitrary code by leveraging this vulnerability. The vulnerability is also associated with the lack of code integrity checks during the download process.

Recommendations For versions prior to 9.3.15, update to version 9.3.15 or later. For versions 9.4.x prior to 9.4.10, update to version 9.4.10 or later. For versions 9.5.x prior to 9.5.5, update to version 9.5.5 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-494

CWE-284

Related Identifiers

BDU:2023-00904

CVE-2016-7048

Affected Products

Postgresql

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-7048 · Security Note
• https://bdu.fstec.ru/vul/2023-00904 · Security Note
• https://postgresql.org/support/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7048 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1378043 · Note