CVE-2018-10925: canonical ubuntu_linux Incorrect Authorization
Vulnerability summary
CVE-2018-10925 is a high (CVSS 8.1) Incorrect Authorization vulnerability in canonical ubuntu_linux. EPSS estimates a 2.24% chance of exploitation in the next 30 days, higher than 82.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 12 · Related 6Timeline
- 09-08-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could exploit this to update other columns in the same table.
CVSS metrics
7 scores · 4 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- NVDNIST7.1HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NDiffers
EPSS trend
Probability
2.24%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
0.00 pp
From 2.24% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine3 products
- postgresql≥ 9.5.0, < 10.5-r0 | ≥ 9.5.0, < 9.6.10-r0
- postgresql14< 10.5-r0
- postgresql15< 10.5-r0
Ubuntu2 products
- postgresql-10< 10.5-0ubuntu0.18.04
- postgresql-9.5< 9.5.14-0ubuntu0.16.04
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04
Debian1 product
- debian_linuxEOL9.0
Postgresql1 product
- postgresql≥ 9.5.0, < 9.5.14 | ≥ 9.6.0, < 9.6.10 | ≥ 10.0, < 10.5
Postgresql global development group1 product
- postgresql10.5 | 9.6.10 | 9.5.14 | 9.4.19 | 9.3.24
6 vendors · 9 products
References
16 links
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
Show all 16 references
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory