UpHeron
All vulnerabilities

Servers and applications

CVE-2018-16850

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.

Severity
Critical 9.8
Published
13 Nov 2018
Last changed
17 Jun 2026
Added to UpHeron
16 Oct 2026
Fixed in
10.6, 11.1
Sources
NVD

Affected software

SoftwareAffected versions
PostgreSQLServers and applications · cpe:a:postgresql:postgresql
  • From 10.0 before 10.6
  • From 11.0 before 11.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-16850
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-16850