CVEvulnerability
CVE-2012-0868
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-07-18
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.
Affected configurations
• postgresql postgresql 8.3
• postgresql postgresql 8.3.1
• postgresql postgresql 8.3.2
• postgresql postgresql 8.3.3
• postgresql postgresql 8.3.4
• postgresql postgresql 8.3.5
• postgresql postgresql 8.3.6
• postgresql postgresql 8.3.7
• postgresql postgresql 8.3.8
• postgresql postgresql 8.3.9
• postgresql postgresql 8.3.10
• postgresql postgresql 8.3.11
• postgresql postgresql 8.3.12
• postgresql postgresql 8.3.13
• postgresql postgresql 8.3.14
• postgresql postgresql 8.3.15
• postgresql postgresql 8.3.16
• postgresql postgresql 8.3.17
• postgresql postgresql 8.4
• postgresql postgresql 8.4.1
• postgresql postgresql 8.4.2
• postgresql postgresql 8.4.3
• postgresql postgresql 8.4.4
• postgresql postgresql 8.4.5
• postgresql postgresql 8.4.6
• postgresql postgresql 8.4.7
• postgresql postgresql 8.4.8
• postgresql postgresql 8.4.9
• postgresql postgresql 8.4.10
• postgresql postgresql 9.0
• postgresql postgresql 9.0.1
• postgresql postgresql 9.0.2
• postgresql postgresql 9.0.3
• postgresql postgresql 9.0.4
• postgresql postgresql 9.0.5
• postgresql postgresql 9.0.6
• postgresql postgresql 9.1
• postgresql postgresql 9.1.1
• postgresql postgresql 9.1.2
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 kb.juniper.net
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html lists.opensuse.org
- http://rhn.redhat.com/errata/RHSA-2012-0677.html rhn.redhat.com
- http://rhn.redhat.com/errata/RHSA-2012-0678.html rhn.redhat.com
- http://secunia.com/advisories/49272 secunia.com
- http://secunia.com/advisories/49273 secunia.com
- http://www.debian.org/security/2012/dsa-2418 www.debian.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:026 www.mandriva.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:027 www.mandriva.com
- http://www.postgresql.org/about/news/1377/ Vendor Advisory
- http://www.postgresql.org/docs/8.3/static/release-8-3-18.html www.postgresql.org
- http://www.postgresql.org/docs/8.4/static/release-8-4-11.html www.postgresql.org
- http://www.postgresql.org/docs/9.0/static/release-9-0-7.html www.postgresql.org
- http://www.postgresql.org/docs/9.1/static/release-9-1-3.html www.postgresql.org
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 kb.juniper.net
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html lists.opensuse.org
- http://rhn.redhat.com/errata/RHSA-2012-0677.html rhn.redhat.com
- http://rhn.redhat.com/errata/RHSA-2012-0678.html rhn.redhat.com
- http://secunia.com/advisories/49272 secunia.com
- http://secunia.com/advisories/49273 secunia.com
- http://www.debian.org/security/2012/dsa-2418 www.debian.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:026 www.mandriva.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:027 www.mandriva.com
- http://www.postgresql.org/about/news/1377/ Vendor Advisory
- http://www.postgresql.org/docs/8.3/static/release-8-3-18.html www.postgresql.org
- http://www.postgresql.org/docs/8.4/static/release-8-4-11.html www.postgresql.org
- http://www.postgresql.org/docs/9.0/static/release-9-0-7.html www.postgresql.org
- http://www.postgresql.org/docs/9.1/static/release-9-1-3.html www.postgresql.org