CVE-2017-16082: Code Injection
First published: Thu Jun 07 2018(Updated: )
A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/pg | >=7.1.0<7.1.2 | 7.1.2 |
| npm/pg | >=7.0.0<7.0.2 | 7.0.2 |
| npm/pg | >=6.4.0<6.4.2 | 6.4.2 |
| npm/pg | >=6.3.0<6.3.3 | 6.3.3 |
| npm/pg | >=6.2.0<6.2.5 | 6.2.5 |
| npm/pg | >=6.1.0<6.1.6 | 6.1.6 |
| npm/pg | >=6.0.0<6.0.5 | 6.0.5 |
| npm/pg | >=5.0.0<5.2.1 | 5.2.1 |
| npm/pg | >=4.0.0<4.5.7 | 4.5.7 |
| npm/pg | >=3.0.0<3.6.4 | 3.6.4 |
| npm/pg | <2.11.2 | 2.11.2 |
| PostgreSQL | >=2.0.0<2.11.2 | |
| PostgreSQL | >=3.0.0<3.6.4 | |
| PostgreSQL | >=4.0.0<4.5.7 | |
| PostgreSQL | >5.0.0<5.2.1 | |
| PostgreSQL | >=6.0.0<6.4.2 | |
| PostgreSQL | >=7.0.0<7.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-16082?
CVE-2017-16082 is classified as a high severity vulnerability due to its remote code execution capabilities.
How do I fix CVE-2017-16082?
To fix CVE-2017-16082, upgrade to pg versions 7.1.2, 7.0.2, 6.4.2, or 6.3.3 or later.
What causes CVE-2017-16082?
CVE-2017-16082 is caused by the processing of specially crafted column names in user-supplied SQL queries.
Which systems are affected by CVE-2017-16082?
CVE-2017-16082 affects versions of the pg module in Node.js from 2.0.0 to 7.1.1.
How can I test for CVE-2017-16082 in my application?
You can test for CVE-2017-16082 by running SQL queries that utilize unsafe, user-supplied column names to check for unexpected behavior.
- collector/github-advisory-latest
- alias/GHSA-wc9v-mj63-m9g5
- alias/CVE-2017-16082
- agent/type
- agent/weakness
- agent/severity
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/npm
- vendor/node-postgres
- canonical/postgresql
- version/postgresql/2.0.0
- version/postgresql/3.0.0
- version/postgresql/4.0.0
- version/postgresql/6.0.0
- version/postgresql/7.0.0