CVE-2018-1058 Privilege escalation in postgresql

High 8.8 Published 2 Mar 2018 Updated 17 Sep 2024

An authenticated user can escalate privileges to superuser and execute arbitrary code by manipulating query behavior in PostgreSQL.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-1058?

CVE-2018-1058 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 2 Mar 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.

Weakness: CWE-20

Which versions are affected by CVE-2018-1058?

It affects 3 products.

Linux distribution packages (26)

`postgresql94` SUSE:Linux Enterprise Desktop 12 SP2	All versions	`9.4.17-21.19.1`
`postgresql96` SUSE:Linux Enterprise Desktop 12 SP2	All versions	`9.6.8-3.16.1`
`postgresql96-libs` SUSE:Linux Enterprise Desktop 12 SP2	All versions	`9.6.8-3.16.1`
`postgresql96` SUSE:Linux Enterprise Desktop 12 SP3	All versions	`9.6.8-3.16.1`
`postgresql96-libs` SUSE:Linux Enterprise Desktop 12 SP3	All versions	`9.6.8-3.16.1`
`postgresql94` SUSE:Linux Enterprise Server 11 SP4	All versions	`9.4.17-0.23.16.1`
`postgresql94-libs` SUSE:Linux Enterprise Server 11 SP4	All versions	`9.4.17-0.23.16.1`
`postgresql94` SUSE:Linux Enterprise Server 12 SP2	All versions	`9.4.17-21.19.1`
`postgresql96` SUSE:Linux Enterprise Server 12 SP2	All versions	`9.6.8-3.16.1`
`postgresql96-libs` SUSE:Linux Enterprise Server 12 SP2	All versions	`9.6.8-3.16.1`
`postgresql96` SUSE:Linux Enterprise Server 12 SP3	All versions	`9.6.8-3.16.1`
`postgresql96-libs` SUSE:Linux Enterprise Server 12 SP3	All versions	`9.6.8-3.16.1`
`postgresql94` SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2	All versions	`9.4.17-21.19.1`
`postgresql96` SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2	All versions	`9.6.8-3.16.1`
`postgresql96-libs` SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2	All versions	`9.6.8-3.16.1`
`postgresql94` SUSE:Linux Enterprise Server for SAP Applications 11 SP4	All versions	`9.4.17-0.23.16.1`
`postgresql94-libs` SUSE:Linux Enterprise Server for SAP Applications 11 SP4	All versions	`9.4.17-0.23.16.1`
`postgresql94` SUSE:Linux Enterprise Server for SAP Applications 12 SP2	All versions	`9.4.17-21.19.1`
`postgresql96` SUSE:Linux Enterprise Server for SAP Applications 12 SP2	All versions	`9.6.8-3.16.1`
`postgresql96-libs` SUSE:Linux Enterprise Server for SAP Applications 12 SP2	All versions	`9.6.8-3.16.1`
`postgresql96` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`9.6.8-3.16.1`
`postgresql96-libs` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`9.6.8-3.16.1`
`postgresql94-libs` SUSE:Linux Enterprise Software Development Kit 11 SP4	All versions	`9.4.17-0.23.16.1`
`postgresql94-libs` SUSE:Linux Enterprise Software Development Kit 12 SP2	All versions	`9.4.17-21.19.1`
`postgresql96-libs` SUSE:Linux Enterprise Software Development Kit 12 SP2	All versions	`9.6.8-3.16.1`
`postgresql96-libs` SUSE:Linux Enterprise Software Development Kit 12 SP3	All versions	`9.6.8-3.16.1`

Products include Canonical Ubuntu Linux, Postgresql Postgresql, Redhat Cloudforms.

How do I fix CVE-2018-1058?

Apply the vendor's patch.

Is CVE-2018-1058 being exploited?

There is no known exploitation of CVE-2018-1058 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2018-1058, CLEANSTART-2026-WH02065, GHSA-wj3f-f94q-2r98, SUSE-SU-2018:0755-1, SUSE-SU-2018:0756-1, SUSE-SU-2018:0876-1 and 2 more.