CVE-2018-16850

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 11.1 PostgreSQL versions prior to 10.6

Description The issue is related to SQL injection in pg upgrade and pg dump via CREATE TRIGGER ... REFERENCING. An attacker can cause arbitrary SQL statements to run with superuser privileges by using a purpose-crafted trigger definition. The vulnerability is due to a lack of protection of the SQL query structure, allowing a remote attacker to execute arbitrary SQL commands.

Recommendations For versions prior to 11.1, update to version 11.1 or later to resolve the issue. For versions prior to 10.6, update to version 10.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of CREATE TRIGGER ... REFERENCING in pg upgrade and pg dump until a patch is available.