Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

ubuntu логотип

CVE-2025-8715

Опубликовано: 14 авг. 2025
Источник: ubuntu
Приоритет: medium
CVSS3: 8.8

Описание

Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.

РелизСтатусПримечание
devel

DNE

esm-infra/bionic

needs-triage

jammy

DNE

noble

DNE

plucky

DNE

questing

DNE

upstream

ignored

end of life

Показывать по

РелизСтатусПримечание
devel

DNE

esm-infra/focal

needs-triage

jammy

DNE

noble

DNE

plucky

DNE

questing

DNE

upstream

ignored

end of life

Показывать по

РелизСтатусПримечание
devel

DNE

jammy

released

14.19-0ubuntu0.22.04.1
noble

DNE

plucky

DNE

questing

DNE

upstream

released

14.19

Показывать по

РелизСтатусПримечание
devel

DNE

jammy

DNE

noble

released

16.10-0ubuntu0.24.04.1
plucky

DNE

questing

DNE

upstream

released

16.10

Показывать по

РелизСтатусПримечание
devel

released

17.6-1
jammy

DNE

noble

DNE

plucky

released

17.6-0ubuntu0.25.04.1
questing

released

17.6-1
upstream

released

17.6

Показывать по

РелизСтатусПримечание
devel

DNE

esm-infra-legacy/trusty

deferred

2019-08-23
jammy

DNE

noble

DNE

plucky

DNE

questing

DNE

upstream

ignored

end of life

Показывать по

РелизСтатусПримечание
devel

DNE

esm-infra/xenial

needs-triage

jammy

DNE

noble

DNE

plucky

DNE

questing

DNE

upstream

ignored

end of life

Показывать по

8.8 High

CVSS3

Связанные уязвимости

CVSS3: 8.8
redhat
4 месяца назад

Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.

CVSS3: 8.8
nvd
4 месяца назад

Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.

CVSS3: 8.8
msrc
3 месяца назад

PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server

CVSS3: 8.8
debian
4 месяца назад

Improper neutralization of newlines in pg_dump in PostgreSQL allows a ...

CVSS3: 8.8
github
4 месяца назад

Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.

8.8 High

CVSS3