CVE-2018-25088 json
Blue Yonder postgraas_server PostgreSQL Backend postgres_cluster_driver.py create_postgres_db sql injection
published 3y ago modified 4mo ago also GHSA-vghm-8cjp-hjw6 , PYSEC-2026-460 , EUVD-2023-2150
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
A vulnerability, which was classified as critical, was found in Blue Yonder postgraas_server up to 2.0.0b2. Affected is the function _create_pg_connection/create_postgres_db of the file postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py of the component PostgreSQL Backend Handler. The manipulation leads to sql injection. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 7cd8d016edc74a78af0d81c948bfafbcc93c937c. It is recommended to upgrade the affected component. VDB-234246 is the identifier assigned to this vulnerability.
Patch / fix
- pypi postgraas-server 2.0.0
- blueyonder postgraas_server 2.0.0
Is CVE-2018-25088 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 5.5 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 5.2 | AV:A/AC:L/Au:S/C:P/I:P/A:P |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | postgraas-server | <2.0.0 |
2.0.0 |
Affected products
- Blue Yonder postgraas_server
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/blue-yonder/postgraas_server/commit/7cd8d016edc74a78af0d81c948bfafbcc93c937c
patch, web
-
github.com
/blue-yonder/postgraas_server/releases/tag/v2.0.0
patch, web, release-notes
-
vuldb.com
/?id.234246
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.234246
signature, permissions-required, web
-
nvd.nist.gov
/vuln/detail/CVE-2018-25088
advisory
-
github.com
/blue-yonder/postgraas_server
package
-
pypi.org
/project/postgraas-server
package
-
github.com
/advisories/GHSA-vghm-8cjp-hjw6
advisory
Sources
- CVE List CVE-2018-25088
- GitHub Advisory GHSA-vghm-8cjp-hjw6
- NVD CVE-2018-25088
- OSV PYSEC-2026-460
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.