CVE-2012-1618
postgresql: no CVSS score yet. EPSS 2.9% chance of exploitation in the next 30 days. Fixed in org.postgresql:postgresql 8.2.
Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.
- EPSS
- 2.9% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- postgresql:postgresql
- postgresql:postgresql_jdbc_driver
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h86w-m5rm-xr33 | Maven | org.postgresql:postgresql | <8.2 | 8.2 |