postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.

An update of the postgresql package has been released.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3757 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql10-postgresql (10.6).
    (BZ#1649369)

    Security Fix(es):

    * postgresql: SQL injection in pg_upgrade and pg_dump, via CREATE TRIGGER ... REFERENCING (CVE-2018-16850)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - postgresql before versions 11.1, 10.6 is vulnerable to     a to SQL injection in pg_upgrade and pg_dump via CREATE     TRIGGER ... REFERENCING. Using a purpose-crafted     trigger definition, an attacker can cause arbitrary SQL     statements to run, with superuser     privileges.(CVE-2018-16850)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql10 fixes the following issues :

Security issue fixed :

  - CVE-2018-16850: Fixed improper quoting of transition     table names when pg_dump emits CREATE TRIGGER could have     caused privilege escalation (bsc#1114837). 

Non-security issues fixed :

  - Update to release 10.6 :

  - https://www.postgresql.org/docs/current/static/release-10-6.html

This update was imported from the SUSE:SLE-15:Update update project.

This update for postgresql10 fixes the following issues :

Security issue fixed :

CVE-2018-16850: Fixed improper quoting of transition table names when pg_dump emits CREATE TRIGGER could have caused privilege escalation (bsc#1114837).

Non-security issues fixed: Update to release 10.6 :

  - https://www.postgresql.org/docs/current/static/release-10-6.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201811-24 (PostgreSQL: SQL injection)

    A vulnerability was discovered in PostgreSQL&rsquo;s pg_upgrade and pg_dump.
  Impact :

    An attacker, by enticing a user to process a specially crafted trigger       definition, can execute arbitrary SQL statements with superuser       privileges.
  Workaround :

    There is no known workaround at this time.

This update for postgresql10 fixes the following issues :

Security issue fixed :

  - CVE-2018-16850: Fixed improper quoting of transition     table names when pg_dump emits CREATE TRIGGER could have     caused privilege escalation (bsc#1114837).

Non-security issues fixed :

  - Update to release 10.6 :

  - https://www.postgresql.org/docs/current/static/release-10-6.html

This update was imported from the SUSE:SLE-12:Update update project.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3818-1 advisory.

    It was discovered that PostgreSQL incorrectly handled certain trigger definitions when running pg_upgrade     or pg_dump. A remote attacker could possibly use this issue to execute arbitrary SQL statements with     superuser privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of PostgreSQL installed on the remote host is 9.3.x prior to 9.3.25, 9.4.x prior to 9.4.20, 9.5.x prior to 9.5.15, 9.6.x prior to 9.6.11, 10.x prior to 10.6, or 11.x prior to 11.1.
It is, therefore, affected by following vulnerability:

 - An SQL injection (SQLi) vulnerability exists in pg_upgrade and  pg_dump via CREATE TRIGGER ... REFERENCING. An authenticated, remote  attacker can exploit this to execute arbitrary SQL statements  with superuser privileges.

The PostgreSQL project reports :

CVE-2018-16850: SQL injection in pg_upgrade and pg_dump, via CREATE TRIGGER ... REFERENCING.

Using a purpose-crafted trigger definition, an attacker can run arbitrary SQL statements with superuser privileges when a superuser runs pg_upgrade on the database or during a pg_dump dump/restore cycle. This attack requires a CREATE privilege on some non-temporary schema or a TRIGGER privilege on a table. This is exploitable in the default PostgreSQL configuration, where all users have CREATE privilege on public schema.

ID	Name	Product	Family	Severity
203048	Photon OS 3.0: Postgresql PHSA-2019-3.0-0010	Nessus	PhotonOS Local Security Checks	critical
194016	RHEL 7 : rh-postgresql10-postgresql (RHSA-2018:3757)	Nessus	Red Hat Local Security Checks	critical
131363	EulerOS 2.0 SP8 : postgresql (EulerOS-SA-2019-2297)	Nessus	Huawei Local Security Checks	critical
123392	openSUSE Security Update : postgresql10 (openSUSE-2019-967)	Nessus	SuSE Local Security Checks	critical
120173	SUSE SLED15 / SLES15 Security Update : postgresql10 (SUSE-SU-2018:3942-1)	Nessus	SuSE Local Security Checks	critical
119644	SUSE SLED12 / SLES12 Security Update : postgresql10 (SUSE-SU-2018:3770-2)	Nessus	SuSE Local Security Checks	critical
119537	openSUSE Security Update : postgresql10 (openSUSE-2018-1493)	Nessus	SuSE Local Security Checks	critical
119319	GLSA-201811-24 : PostgreSQL: SQL injection	Nessus	Gentoo Local Security Checks	critical
119137	openSUSE Security Update : postgresql10 (openSUSE-2018-1460)	Nessus	SuSE Local Security Checks	critical
119011	SUSE SLED12 / SLES12 Security Update : postgresql10 (SUSE-SU-2018:3770-1)	Nessus	SuSE Local Security Checks	critical
118966	Ubuntu 18.04 LTS : PostgreSQL vulnerability (USN-3818-1)	Nessus	Ubuntu Local Security Checks	critical
118936	PostgreSQL 9.3.x < 9.3.25 / 9.4.x < 9.4.20 / 9.5.x < 9.5.15 / 9.6.x < 9.6.11 / 10.x < 10.6 / 11.x < 11.1 SQL injection	Nessus	Databases	critical
118844	FreeBSD : PostgreSQL -- SQL injection in pg_upgrade and pg_dump (1c27a706-e3aa-11e8-b77a-6cc21735f730)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2018-16850

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical