Postgres (pg) vulnerabilities and security advisories

$ latest 1 · 1 critical, high or exploited

• criticalJul 24, 2018

  Remote Code Execution in pg

  • pg < 2.11.2 · fixed in 2.11.2
  • pg >= 3.0.0, < 3.6.4 · fixed in 3.6.4
  • pg >= 4.0.0, < 4.5.7 · fixed in 4.5.7
  • pg >= 5.0.0, < 5.2.1 · fixed in 5.2.1
  • pg >= 6.0.0, < 6.0.5 · fixed in 6.0.5
  • pg >= 6.1.0, < 6.1.6 · fixed in 6.1.6
  • pg >= 6.2.0, < 6.2.5 · fixed in 6.2.5
  • pg >= 6.3.0, < 6.3.3 · fixed in 6.3.3
  • pg >= 6.4.0, < 6.4.2 · fixed in 6.4.2
  • pg >= 7.0.0, < 7.0.2 · fixed in 7.0.2
  • pg >= 7.1.0, < 7.1.2 · fixed in 7.1.2
  GHSA-wc9v-mj63-m9g5CVE-2017-16082

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-wc9v-mj63-m9g5 (CVE-2017-16082), severity critical
  What it is: Remote Code Execution in pg
  Affected packages:
  - pg: affected versions < 2.11.2. Fixed in 2.11.2.
  - pg: affected versions >= 3.0.0, < 3.6.4. Fixed in 3.6.4.
  - pg: affected versions >= 4.0.0, < 4.5.7. Fixed in 4.5.7.
  - pg: affected versions >= 5.0.0, < 5.2.1. Fixed in 5.2.1.
  - pg: affected versions >= 6.0.0, < 6.0.5. Fixed in 6.0.5.
  - pg: affected versions >= 6.1.0, < 6.1.6. Fixed in 6.1.6.
  - pg: affected versions >= 6.2.0, < 6.2.5. Fixed in 6.2.5.
  - pg: affected versions >= 6.3.0, < 6.3.3. Fixed in 6.3.3.
  - pg: affected versions >= 6.4.0, < 6.4.2. Fixed in 6.4.2.
  - pg: affected versions >= 7.0.0, < 7.0.2. Fixed in 7.0.2.
  - pg: affected versions >= 7.1.0, < 7.1.2. Fixed in 7.1.2.
  Details: https://github.com/advisories/GHSA-wc9v-mj63-m9g5
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

From the GitHub Advisory Database, refreshed hourly. Full history on GitHub.