CVE-2018-16850 — Vulnetix

Try Vulnetix Request Demo

CVE-2018-16850 PUBLISHED

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.

EPSS 1.32% · 79.8th percentile

Risk Scores

EPSS Score

1.32%

79.8th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:18.04:LTS	postgresql-10	0, 10.1-1, 10.1-2

Timeline

Nov 8, 2018 CVE Published
Apr 14, 2021 EPSS Score
Feb 4, 2022 EPSS Score
Mar 18, 2025 EPSS Score
Mar 19, 2025 EPSS Score
Mar 21, 2025 EPSS Score
Mar 22, 2025 EPSS Score
Mar 31, 2025 EPSS Score
Apr 10, 2025 EPSS Score
Apr 11, 2025 EPSS Score
Apr 12, 2025 EPSS Score
May 4, 2025 EPSS Score

References

https://ubuntu.com/security/CVE-2018-16850 third-party-advisory
https://www.postgresql.org/about/news/1905/ third-party-advisory
https://ubuntu.com/security/notices/USN-3818-1 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2018-16850 third-party-advisory

Open in Interactive Console →