KLA11196 Multiple vulnerabilities in PostgreSQL

Multiple serious vulnerabilities have been found in PostgreSQL. Malicious users can exploit these vulnerabilities to bypass security restrictions and obtain sensitive information.

Below is a complete list of vulnerabilities:

1. A memory disclosure vulnerability in table partitioning can be exploited remotely to bypass security restrictions via purpose-crafted insert to a partitioned table;
2. An unspecified vulnerability related to creating files in current working directory can be exploited to obtain sensitive information via reading or modifying file with database passwords.

Original advisories

Security Information

Related products

PostgreSQL

CVE list

CVE-2018-1053 warning

CVE-2018-1052 warning

Solution

Update to the latest version

Download PostgreSQL

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• PostgreSQL 9.3 earlier than 9.3.21PostgreSQL 9.4 earlier than 9.4.16PostgreSQL 9.5 earlier than 9.5.11PostgreSQL 9.6 earlier than 9.6.7PostgreSQL 10 earlier than 10.2