CVE-2010-1169: postgresql Improper Control of Generation of Code

Modified

Published 19-05-2010Last modified 07-08-2024

Vulnerability summary

CVE-2010-1169 is a high (CVSS 8.5) Improper Control of Generation of Code vulnerability in postgresql. EPSS estimates a 4.08% chance of exploitation in the next 30 days, higher than 90.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 8.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

8.5/10

010

High · v2.0 (NVD)

EPSS score

4.08%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 3

DSA-2051-1 OPENSUSE-SU-2024:10030-1 OPENSUSE-SU-2024:10256-1 OPENSUSE-SU-2024:10273-1 RHSA-2010:0427 RHSA-2010:0428+2 more

Timeline

19-05-2010
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 does not properly restrict PL/perl procedures, which allows remote authenticated users, with database-creation privileges, to execute arbitrary Perl code via a crafted script, related to the Safe module (aka Safe.pm) for Perl. NOTE: some sources report that this issue is the same as CVE-2010-1447.

CVSS metrics

1 score · 1 source · 1 version

v2.08.5

EPSS trend

Probability

4.08%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.08% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Version check

Known conditions: network-reachable, authentication (CVSS vector). Other conditions: not stated in public data.

Postgresql1 product

postgresqlEOL7.4 | 7.4.1 | 7.4.2 | 7.4.3 | 7.4.4 | 7.4.5 | 7.4.6 | 7.4.7 | 7.4.8 | 7.4.9 | 7.4.10 | 7.4.11 | 7.4.12 | 7.4.13 | 7.4.14 | 7.4.15 | 7.4.16 | 7.4.17 | 7.4.18 | 7.4.19 | 7.4.20 | 7.4.21 | 7.4.22 | 7.4.23 | 7.4.24 | 7.4.25 | 7.4.26 | 7.4.27 | 7.4.28 | 8.0 | 8.0.0 | 8.0.1 | 8.0.2 | 8.0.3 | 8.0.4 | 8.0.5 | 8.0.6 | 8.0.7 | 8.0.8 | 8.0.9 | 8.0.10 | 8.0.11 | 8.0.12 | 8.0.13 | 8.0.14 | 8.0.15 | 8.0.16 | 8.0.17 | 8.0.18 | 8.0.19 | 8.0.20 | 8.0.21 | 8.0.22 | 8.0.23 | 8.0.24 | 8.1 | 8.1.0 | 8.1.1 | 8.1.2 | 8.1.3 | 8.1.4 | 8.1.5 | 8.1.6 | 8.1.7 | 8.1.8 | 8.1.9 | 8.1.10 | 8.1.11 | 8.1.12 | 8.1.13 | 8.1.14 | 8.1.15 | 8.1.16 | 8.1.17 | 8.1.18 | 8.1.19 | 8.1.20 | 8.2 | 8.2.1 | 8.2.2 | 8.2.3 | 8.2.4 | 8.2.5 | 8.2.6 | 8.2.7 | 8.2.8 | 8.2.9 | 8.2.10 | 8.2.11 | 8.2.12 | 8.2.13 | 8.2.14 | 8.2.15 | 8.2.16 | 8.3 | 8.3.1 | 8.3.2 | 8.3.3 | 8.3.4 | 8.3.5 | 8.3.6 | 8.3.7 | 8.3.8 | 8.3.9 | 8.3.10 | 8.4 | 8.4.1 | 8.4.2 | 8.4.3 | 9.0.0:beta1

1 vendor · 1 product

References

38 links

www.postgresql.org/docs/current/static/release-8-1-21.htmlX Refsource CONFIRM
lists.fedoraproject.org/pipermail/package-announce/2010-May/041579.htmlVendor AdvisoryX Refsource FEDORA
www.postgresql.org/about/news.1203X Refsource CONFIRMPatch
www.redhat.com/support/errata/RHSA-2010-0427.htmlVendor AdvisoryX Refsource REDHAT
www.redhat.com/support/errata/RHSA-2010-0428.htmlVendor AdvisoryX Refsource REDHAT
marc.info?l=bugtraq&m=134124585221119&w=2Vendor AdvisoryX Refsource HP
exchange.xforce.ibmcloud.com/vulnerabilities/58693VDB EntryX Refsource XF
www.debian.org/security/2010/dsa-2051Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/39898Third Party AdvisoryX Refsource SECUNIA
www.postgresql.org/docs/current/static/release-7-4-29.htmlX Refsource CONFIRM

Show all 38 references

secunia.com/advisories/39820Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2010/1198VDB EntryX Refsource VUPEN
www.postgresql.org/docs/current/static/release-8-0-25.htmlX Refsource CONFIRM
www.vupen.com/english/advisories/2010/1167VDB EntryX Refsource VUPENVendor Advisory
www.vupen.com/english/advisories/2010/1221VDB EntryX Refsource VUPEN
secunia.com/advisories/39845Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/bid/40215VDB EntryX Refsource BID
www.postgresql.org/docs/current/static/release-8-3-11.htmlX Refsource CONFIRM
www.vupen.com/english/advisories/2010/1207VDB EntryX Refsource VUPEN
www.postgresql.org/docs/current/static/release-8-2-17.htmlX Refsource CONFIRM
www.redhat.com/support/errata/RHSA-2010-0430.htmlVendor AdvisoryX Refsource REDHAT
www.postgresql.org/support/securityX Refsource CONFIRM
lists.fedoraproject.org/pipermail/package-announce/2010-May/041559.htmlVendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/pipermail/package-announce/2010-May/041591.htmlVendor AdvisoryX Refsource FEDORA
www.postgresql.org/docs/current/static/release-8-4-4.htmlX Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.htmlVendor AdvisoryX Refsource SUSE
www.vupen.com/english/advisories/2010/1182VDB EntryX Refsource VUPEN
bugzilla.redhat.com/show_bug.cgi?id=582615X Refsource CONFIRM
secunia.com/advisories/39815Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10645VDB EntrySignatureX Refsource OVAL
www.redhat.com/support/errata/RHSA-2010-0429.htmlVendor AdvisoryX Refsource REDHAT
www.mandriva.com/security/advisories?name=MDVSA-2010:103Vendor AdvisoryX Refsource MANDRIVA
www.securitytracker.com/id?1023988VDB EntryX Refsource SECTRACK
www.openwall.com/lists/oss-security/2010/05/20/5Mailing ListX Refsource MLIST
secunia.com/advisories/39939Third Party AdvisoryX Refsource SECUNIA
osvdb.org/64755VDB EntryX Refsource OSVDB
bugzilla.redhat.com/show_bug.cgi?id=588269X Refsource CONFIRM
www.vupen.com/english/advisories/2010/1197VDB EntryX Refsource VUPEN