Unescaped parameters in the PostgreSQL JDBC driver

published 2012-10-06 14 y ago modified 2026-06-16 4 mo ago also GHSA-h86w-m5rm-xr33 , EUVD-2022-4105

cvss: 7.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.9%; EPSS 2.9% chance of exploitation in 30 days, percentile 87%
public exploits: 0; none known

Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.

Patch / fix

fixed in 1

maven org.postgresql:postgresql 8.2

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-1618 updated 2026-11-07 cvss 5.0

postgresql-jdbc: SQL injection due improper escaping of JDBC statement parameters

Red Hat Enterprise Linux 5 postgresql-jdbc Red Hat Enterprise Linux 6 postgresql-jdbc
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.94% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

ecosystem	package	affected	fixed in
maven	org.postgresql:postgresql	<8.2	8.2

Classification

Technology feeds

PostgreSQL rss critical rss

References

openwall.com /lists/oss-security/2012/03/30/9
mailing-list, web
openwall.com /lists/oss-security/2012/04/02/4
mailing-list, web
bugzilla.novell.com /show_bug.cgi?id=754273
web
openwall.com /lists/oss-security/2012/04/04/9
mailing-list, web
osvdb.org /80641
vdb-entry, web
lists.opensuse.org /opensuse-security/2012-03/msg00024.html
mailing-list, web
openwall.com /lists/oss-security/2012/04/04/5
mailing-list, web
openwall.com /lists/oss-security/2012/04/04/4
mailing-list, web
openwall.com /lists/oss-security/2012/03/30/8
mailing-list, web
openwall.com /lists/oss-security/2012/04/04/11
mailing-list, web
openwall.com /lists/oss-security/2012/03/31/1
mailing-list, web
archives.neohapsis.com /archives/bugtraq/2012-03/0126.html
mailing-list, web
nvd.nist.gov /vuln/detail/CVE-2012-1618
advisory
github.com /pgjdbc/pgjdbc
package

Sources

CVE List CVE-2012-1618
GitHub Advisory GHSA-h86w-m5rm-xr33
NVD CVE-2012-1618

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary