Critical, CVSS 9.8npmAmendedPublished
Remote Code Execution in pg
CVE-2017-16082 · GHSA-wc9v-mj63-m9g5
- Affected
- npm pg < 2.11.2; >= 3.0.0, < 3.6.4; >= 4.0.0, < 4.5.7; >= 5.0.0, < 5.2.1; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.6; >= 6.2.0, < 6.2.5; >= 6.3.0, < 6.3.3; >= 6.4.0, < 6.4.2; >= 7.0.0, < 7.0.2; >= 7.1.0, < 7.1.2
- Fixed in
- 5.2.16.4.26.3.32.11.26.1.63.6.46.2.57.1.24.5.76.0.57.0.2· Vendor fix available
- Issue
- Affected versions of pg contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name. There are two specific scenarios in which it is likely for an application to be vulnerable: 1. The application executes unsafe, user-supplied sql which contains malicious column names. 2. The application connects to an untrusted database and executes a query returning results which contain a malicious column name. Proof of Concept Recommendation Version 2.x.x: Update to version 2.11.2 or later. Version 3.x.x: Update to version 3.6.4 or later. Version 4.x.x: Update to version 4.5.7 or later. Version 5.x.x: Update to version 5.2.1 or later. Version 6.x.x: Update to version 6.4.2 or later. ( Note that versions 6.1.6, 6.2.5, and 6.3.3 are also patched. ) Version 7.x.x: Update to version 7.1.2 or later. ( Note that version 7.0.2 is also patched. )
Recommended action: Upgrade to 7.1.2, 7.0.2, 6.4.2 or 8 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.