Skip to content

CVE-2017-16082 Remote Code Execution in pg

CriticalCVSS 9.8 EPSS 10.5%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.

Affected products

ProductAffected versionsFixed in
npm pg(npm) < 2.11.2 2.11.2
npm pg(npm) >= 3.0.0, < 3.6.4 3.6.4
npm pg(npm) >= 4.0.0, < 4.5.7 4.5.7
npm pg(npm) >= 5.0.0, < 5.2.1 5.2.1
npm pg(npm) >= 6.0.0, < 6.0.5 6.0.5
npm pg(npm) >= 6.1.0, < 6.1.6 6.1.6
npm pg(npm) >= 6.2.0, < 6.2.5 6.2.5
npm pg(npm) >= 6.3.0, < 6.3.3 6.3.3
npm pg(npm) >= 6.4.0, < 6.4.2 6.4.2
npm pg(npm) >= 7.0.0, < 7.0.2 7.0.2
npm pg(npm) >= 7.1.0, < 7.1.2 7.1.2
debian/node-postgres(Debian:12) < 7.7.1-1 7.7.1-1
debian/node-postgres(Debian:13) < 7.7.1-1 7.7.1-1
debian/node-postgres(Debian:14) < 7.7.1-1 7.7.1-1
node-postgres pg >= 2.0.0, < 2.11.2 2.11.2
node-postgres pg >= 3.0.0, < 3.6.4 3.6.4
node-postgres pg >= 4.0.0, < 4.5.7 4.5.7
node-postgres pg >= 5.0.0, < 5.2.1 5.2.1
node-postgres pg >= 6.0.0, < 6.4.2 6.4.2
node-postgres pg >= 7.0.0, < 7.1.2 7.1.2
HackerOne pg node module = < 2.11.2 || >= 3.0.0 < 3.6.4 || >= 4.0.0 < 4.5.7 || >= 5.0.0 < 5.2.1 || >= 6.0.0 < 6.0.5 || >= 6.1.0 < 6.1.6 || >= 6.2.0 < 6.2.5 || >= 6.3.0 < 6.3.3 || >= 6.4.0 < 6.4.2 || >= 7.0.0 < 7.0.2 || No fix listed

References