CVE-2018-10925
High
Description
It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could exploit this to update other columns in the same table.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Postgresql
PublishedAug 9, 2018
First seenAug 9, 2018
Weakness typeCWE-863Incorrect authorization
How to fix
Update
- postgresql postgresql9.5.14, 9.6.10, 10.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postgresql postgresql | 9.5.0 ≤ v < 9.5.14, 9.6.0 ≤ v < 9.6.10, 10.0 ≤ v < 10.5 | 9.5.14, 9.6.10, 10.5 |
| canonical ubuntu_linux | 14.04, 16.04, 18.04 | — |
| debian debian_linux | 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.