What’s Vulnerable › Vulnerabilities

CVE-2018-1058

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 13.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-03-02 · updated 2026-06-17
• Weakness: CWE-20

Description

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 17.10
• PostgreSQL: from 9.3 before 9.3.22; from 9.4 before 9.4.17; from 9.5 before 9.5.12; from 9.6 before 9.6.8; from 10.0 before 10.3 — fixed in 10.3, 9.3.22, 9.4.17, 9.5.12, 9.6.8
• CloudForms: 4.6

How to fix

Upgrade to a fixed version: PostgreSQL 10.3, 9.3.22, 9.4.17, 9.5.12. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/103221
• https://access.redhat.com/errata/RHSA-2018:2511
• https://access.redhat.com/errata/RHSA-2018:2566
• https://access.redhat.com/errata/RHSA-2018:3816
• https://bugzilla.redhat.com/show_bug.cgi?id=1547044
• https://usn.ubuntu.com/3589-1/
• https://www.postgresql.org/about/news/1834/
• http://www.securityfocus.com/bid/103221
• https://access.redhat.com/errata/RHSA-2018:2511
• https://access.redhat.com/errata/RHSA-2018:2566
• https://access.redhat.com/errata/RHSA-2018:3816
• https://bugzilla.redhat.com/show_bug.cgi?id=1547044

Get alerted when CVE-2018-1058 or the next vulnerability affects your stack