CVE-2018-1058
HIGHCVSS 8.8/10EPSS 14.14%
Last modified
CVE-2018-1058 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. EPSS estimates a 14.14% chance of exploitation in the next 30 days.
Description
A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Postgresql | Postgresql | >= 9.3, < 9.3.22 |
| Postgresql | Postgresql | >= 9.4, < 9.4.17 |
| Postgresql | Postgresql | >= 9.5, < 9.5.12 |
| Postgresql | Postgresql | >= 9.6, < 9.6.8 |
| Postgresql | Postgresql | >= 10.0, < 10.3 |
| Canonical | Ubuntu Linux | 14.04 |
| Canonical | Ubuntu Linux | 16.04 |
| Canonical | Ubuntu Linux | 17.10 |
| Redhat | Cloudforms | 4.6 |
References
- http://www.securityfocus.com/bid/103221Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2511Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2566Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3816Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1547044Issue Tracking, Third Party Advisory
- https://usn.ubuntu.com/3589-1/Third Party Advisory
- https://www.postgresql.org/about/news/1834/Vendor Advisory
- http://www.securityfocus.com/bid/103221Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2511Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2566Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3816Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1547044Issue Tracking, Third Party Advisory
- https://usn.ubuntu.com/3589-1/Third Party Advisory
- https://www.postgresql.org/about/news/1834/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-1058?
A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.
How severe is CVE-2018-1058?
CVE-2018-1058 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 14.14% probability of exploitation in the next 30 days.
How do I fix CVE-2018-1058?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-10573interface/fax/fax_dispatch.php in OpenEMR before 5.0.1 allow…
- CVE-2018-10574site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlie…
- CVE-2018-10575An issue was discovered on WatchGuard AP100, AP102, and AP20…
- CVE-2018-10576An issue was discovered on WatchGuard AP100, AP102, and AP20…
- CVE-2018-10577An issue was discovered on WatchGuard AP100, AP102, and AP20…
- CVE-2018-10578An issue was discovered on WatchGuard AP100, AP102, and AP20…
- CVE-2018-10580The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS be…
- CVE-2018-10581In Octopus Deploy 3.4.x before 2018.4.7, an authenticated us…
- CVE-2018-10583An information disclosure vulnerability occurs when LibreOff…
- CVE-2018-10585Pexip Infinity before 18 allows remote Denial of Service (XM…7.5
- CVE-2018-10586NetGain Enterprise Manager (EM) is affected by multiple Stor…
- CVE-2018-10587NetGain Enterprise Manager (EM) is affected by OS Command In…
Are you affected by CVE-2018-1058?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST