CVEvulnerability
CVE-2013-1901
4.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-04-04
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pg_start_backup or (2) pg_stop_backup functions.
Affected configurations
• postgresql postgresql 9.2
• postgresql postgresql 9.2.1
• postgresql postgresql 9.2.2
• postgresql postgresql 9.2.3
• postgresql postgresql 9.1
• postgresql postgresql 9.1.1
• postgresql postgresql 9.1.2
• postgresql postgresql 9.1.3
• postgresql postgresql 9.1.4
• postgresql postgresql 9.1.5
• postgresql postgresql 9.1.6
• postgresql postgresql 9.1.7
• postgresql postgresql 9.1.8
• canonical ubuntu linux 8.04
• canonical ubuntu linux 10.04
• canonical ubuntu linux 11.10
• canonical ubuntu linux 12.04
• canonical ubuntu linux 12.10
Related
Weakness · not in database (1)
References
- http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html lists.apple.com
- http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html lists.apple.com
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102806.html lists.fedoraproject.org
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00007.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00008.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00011.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00012.html lists.opensuse.org
- http://support.apple.com/kb/HT5880 support.apple.com
- http://support.apple.com/kb/HT5892 support.apple.com
- http://www.debian.org/security/2013/dsa-2658 www.debian.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:142 www.mandriva.com
- http://www.postgresql.org/about/news/1456/ Vendor Advisory
- http://www.postgresql.org/docs/current/static/release-9-1-9.html www.postgresql.org
- http://www.postgresql.org/docs/current/static/release-9-2-4.html www.postgresql.org
- http://www.ubuntu.com/usn/USN-1789-1 www.ubuntu.com
- http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html lists.apple.com
- http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html lists.apple.com
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102806.html lists.fedoraproject.org
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00007.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00008.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00011.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00012.html lists.opensuse.org
- http://support.apple.com/kb/HT5880 support.apple.com
- http://support.apple.com/kb/HT5892 support.apple.com
- http://www.debian.org/security/2013/dsa-2658 www.debian.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:142 www.mandriva.com
- http://www.postgresql.org/about/news/1456/ Vendor Advisory
- http://www.postgresql.org/docs/current/static/release-9-1-9.html www.postgresql.org
- http://www.postgresql.org/docs/current/static/release-9-2-4.html www.postgresql.org
- http://www.ubuntu.com/usn/USN-1789-1 www.ubuntu.com