PostgreSQL pg_createsubscriber allows SQL injection via subscription name

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• postgresql postgresql17.0 and later · before 17.10
• postgresql postgresql18.0 and later · before 18.4

Versions reported by the vendor

Affected version ranges reported by the assigning authority (PostgreSQL). Independent of NVD's CPE analysis and usually ahead of it.

• n/a PostgreSQL

  • 18 and later · before 18.4affected · rpm
  • 17 and later · before 17.10affected · rpm

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-7546PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers
  57Plan
• CVE-2019-9193In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to
  55Plan
• CVE-2020-25695A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24.
  49Plan
• CVE-2007-3280The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the
  44Plan
• CVE-2013-1899Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to ca
  42Plan
• CVE-2018-16850postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ...
  41Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = '" + owner + "'"4);

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = $1",4  [owner]5);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.