CVEvulnerability

CVE-2018-10915

7.5 HIGH Published 2018-08-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-08-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.5 HIGH — CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses
CWE-200, CWE-665, CWE-89

Description

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected.

Affected configurations

• redhat openstack 12 • redhat openstack 13 • redhat virtualization 4.0 • redhat enterprise linux desktop 7.0 • redhat enterprise linux server 7.0 • redhat enterprise linux server eus 7.5 • redhat enterprise linux workstation 7.0 • canonical ubuntu linux 14.04 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • debian debian linux 8.0 • debian debian linux 9.0 • postgresql postgresql (>= 9.3.0 < 9.3.24) • postgresql postgresql (>= 9.4.0 < 9.4.19) • postgresql postgresql (>= 9.5.0 < 9.5.14) • postgresql postgresql (>= 9.6.0 < 9.6.10) • postgresql postgresql (>= 10.0 < 10.5)

Related

Weakness · CWE (3)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-665 Improper Initialization weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References