CVE-2018-1058: Input Validation

From upstream advisory:

Supported, Vulnerable Versions: 9.3 - 10. The security team typically does not test unsupported versions, but this problem is quite old.

The PostgreSQL searchpath setting determines schemas searched for tables, functions, operators, etc. The pgdump client application chooses searchpath settings such that every schema may appear at the front of its search path. This permits a user with CREATE privilege on any schema to execute arbitrary SQL functions under the identity of the user running pgdump, often a superuser. This is exploitable in the default configuration, where all users have CREATE privilege on schema "public". The pgupgrade implementation invokes pgdump under a superuser identity, and its usage is vulnerable.

Other client applications, such as vacuumdb, leave searchpath unchanged. In the default configuration, users can create objects in the "public" schema and harness them to execute arbitrary SQL functions under the identity of the user running these programs. The PostgreSQL project estimates this class of vulnerability is pervasive in applications that query PostgreSQL databases, so we are issuing guidance for database administrators and application authors to secure their own work. In brief, one can issue "REVOKE CREATE ON SCHEMA public FROM PUBLIC" to prevent these attacks.

— Red Hat

Postgresql could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the searchpath setting. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code with the permissions of superuser in the database.

— IBM