CVE-2016-5424: Code Injection
It was found that PostgreSQL client programs mishandle database and role names containing newlines, carriage returns, double quotes, or backslashes. By crafting such an object name, roles with the CREATEDB or CREATEROLE option could escalate their privileges to superuser when a superuser next executes maintenance with a vulnerable program. Vulnerable programs include pgdumpall, pgupgrade, vacuumdb, reindexdb, and clusterdb.
Other sources
PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5424?
CVE-2016-5424 is classified as a high severity vulnerability due to the potential for remote authenticated users to gain superuser privileges.
How do I fix CVE-2016-5424?
To fix CVE-2016-5424, you should upgrade to PostgreSQL version 9.5.4, 9.4.9, 9.3.14, 9.2.18, or 9.1.23 as these versions contain the necessary patches.
Who is affected by CVE-2016-5424?
CVE-2016-5424 affects PostgreSQL versions prior to 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4.
What types of roles can exploit CVE-2016-5424?
Remote authenticated users with the CREATEDB or CREATEROLE role can exploit CVE-2016-5424 to escalate their privileges to superuser.
What kind of privileges can be gained from CVE-2016-5424?
CVE-2016-5424 may allow unauthorized escalation to superuser privileges, enabling full access to the database.