Описание
Remote Code Execution in pg
Affected versions of pg contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name.
There are two specific scenarios in which it is likely for an application to be vulnerable:
- The application executes unsafe, user-supplied sql which contains malicious column names.
- The application connects to an untrusted database and executes a query returning results which contain a malicious column name.
Proof of Concept
Recommendation
- Version 2.x.x: Update to version 2.11.2 or later.
- Version 3.x.x: Update to version 3.6.4 or later.
- Version 4.x.x: Update to version 4.5.7 or later.
- Version 5.x.x: Update to version 5.2.1 or later.
- Version 6.x.x: Update to version 6.4.2 or later. ( Note that versions 6.1.6, 6.2.5, and 6.3.3 are also patched. )
- Version 7.x.x: Update to version 7.1.2 or later. ( Note that version 7.0.2 is also patched. )
Пакеты
pg
< 2.11.2
2.11.2
pg
>= 3.0.0, < 3.6.4
3.6.4
pg
>= 4.0.0, < 4.5.7
4.5.7
pg
>= 5.0.0, < 5.2.1
5.2.1
pg
>= 6.0.0, < 6.0.5
6.0.5
pg
>= 6.1.0, < 6.1.6
6.1.6
pg
>= 6.2.0, < 6.2.5
6.2.5
pg
>= 6.3.0, < 6.3.3
6.3.3
pg
>= 6.4.0, < 6.4.2
6.4.2
pg
>= 7.0.0, < 7.0.2
7.0.2
pg
>= 7.1.0, < 7.1.2
7.1.2
Связанные уязвимости
A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.
A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.
A remote code execution vulnerability was found within the pg module w ...