CVE-2012-0868: SQL Injection

Published Jul 18, 2012

Updated

CRLF injection vulnerability in pgdump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.

Affected Software

39 affected components

PostgreSQL postgresql=8.3

PostgreSQL postgresql=8.3.1

PostgreSQL postgresql=8.3.2

PostgreSQL postgresql=8.3.3

PostgreSQL postgresql=8.3.4

PostgreSQL postgresql=8.3.5

PostgreSQL postgresql=8.3.6

PostgreSQL postgresql=8.3.7

PostgreSQL postgresql=8.3.8

PostgreSQL postgresql=8.3.9

PostgreSQL postgresql=8.3.10

PostgreSQL postgresql=8.3.11

PostgreSQL postgresql=8.3.12

PostgreSQL postgresql=8.3.13

PostgreSQL postgresql=8.3.14

PostgreSQL postgresql=8.3.15

PostgreSQL postgresql=8.3.16

PostgreSQL postgresql=8.3.17

PostgreSQL postgresql=8.4

PostgreSQL postgresql=8.4.1

PostgreSQL postgresql=8.4.2

PostgreSQL postgresql=8.4.3

PostgreSQL postgresql=8.4.4

PostgreSQL postgresql=8.4.5

PostgreSQL postgresql=8.4.6

PostgreSQL postgresql=8.4.7

PostgreSQL postgresql=8.4.8

PostgreSQL postgresql=8.4.9

PostgreSQL postgresql=8.4.10

PostgreSQL postgresql=9.0

PostgreSQL postgresql=9.0.1

PostgreSQL postgresql=9.0.2

PostgreSQL postgresql=9.0.3

PostgreSQL postgresql=9.0.4

PostgreSQL postgresql=9.0.5

PostgreSQL postgresql=9.0.6

PostgreSQL postgresql=9.1

PostgreSQL postgresql=9.1.1

PostgreSQL postgresql=9.1.2

Event History

Jul 18, 2012

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0868?

CVE-2012-0868 is considered a high-severity vulnerability due to its potential to allow remote attackers to execute arbitrary SQL commands.

How do I fix CVE-2012-0868?

To mitigate CVE-2012-0868, upgrade PostgreSQL to versions 8.3.18, 8.4.11, 9.0.7, or 9.1.3 or later.

What versions of PostgreSQL are affected by CVE-2012-0868?

CVE-2012-0868 affects PostgreSQL versions 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3.

Can CVE-2012-0868 be exploited remotely?

Yes, CVE-2012-0868 can be exploited by remote attackers but requires user assistance to execute the attack.

What is CRLF injection in context of CVE-2012-0868?

CRLF injection in CVE-2012-0868 refers to the vulnerability where newlines are inserted into SQL commands via crafted files, potentially altering command execution.