EN PT-BR
← Voltar ao feed
medium

CERT-FR Advisory: Multiple Vulnerabilities in PostgreSQL ODBC Driver Allow SQL Injection and Security Bypass

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 21:00 · coletado há 1 hora

CERT-FR published advisory CERTFR-2026-AVI-1445 on 03 November 2026 covering multiple vulnerabilities in PostgreSQL ODBC (psqlODBC) affecting versions prior to 18.00.0006. The flaws allow an attacker to perform SQL injection (SQLi), bypass security policy mechanisms, and exploit an unspecified vendor-acknowledged security issue. CERT-FR references the official PostgreSQL security bulletin for psqlODBC published 02 November 2026 along with the project's changelog, and lists ten associated CVE identifiers (CVE-2026-120057 through CVE-2026-120067, excluding gaps). Administrators are directed to the vendor advisory for applicable patches.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1445 covers multiple vulnerabilities in PostgreSQL ODBC (psqlODBC), affecting all versions before 18.00.0006 and fixed in 18.00.0006. The advisory says they allow SQL injection, a security policy bypass and an unspecified security issue. It lists eleven CVEs, CVE-2026-120057 through CVE-2026-120067 (the story text says ten), but does not map each CVE to a flaw type, severity, or attacker requirements such as authentication or network reach. Details must be taken from the vendor bulletin.

Como foi descoberta

The articles do not say who found the flaws or how. CERT-FR published its advisory on 03 November 2026, pointing to the PostgreSQL security release bulletin for psqlODBC and the project's changelog for 18.00.0006, both dated 02 November 2026.

Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 14:27.

Detalhes técnicos

  • Vulnerabilities include SQL injection (SQLi), security policy bypass, and an unspecified security issue.
  • Affected: PostgreSQL ODBC (psqlODBC) versions prior to 18.00.0006.
  • Ten CVEs assigned: CVE-2026-120057, CVE-2026-120058, CVE-2026-120059, CVE-2026-120060, CVE-2026-120061, CVE-2026-120062, CVE-2026-120063, CVE-2026-120064, CVE-2026-120065, CVE-2026-120066, CVE-2026-120067.
  • Referenced sources: PostgreSQL security release bulletin for psqlODBC (02 November 2026) and the psqlODBC GitHub Changelog (18.00.0006, 02 November 2026).

Remediação

  • Upgrade PostgreSQL ODBC driver to version 18.00.0006 or later as described in the vendor security bulletin.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 02/11/2026 21:00 · coletado 04/11 14:01 primeiro registro

    CERT-FR Advisory: Multiple Vulnerabilities in PostgreSQL ODBC Driver Allow SQL Injection and Security Bypass

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1445 on 03 November 2026 covering multiple vulnerabilities in PostgreSQL ODBC (psqlODBC) affecting versions prior to 18.00.0006. The flaws allow an attacker to perform SQL injection (SQLi), bypass security policy mechanisms, and exploit an unspecified vendor-acknowledged security issue. CERT-FR references the official PostgreSQL security bulletin for psqlODBC published 02 November 2026 along with the project's changelog, and lists ten associated CVE identifiers (CVE-2026-120057 through CVE-2026-120067, excluding gaps). Administrators are directed to the vendor advisory for applicable patches.

    Technical Details

    • Vulnerabilities include SQL injection (SQLi), security policy bypass, and an unspecified security issue.
    • Affected: PostgreSQL ODBC (psqlODBC) versions prior to 18.00.0006.
    • Ten CVEs assigned: CVE-2026-120057, CVE-2026-120058, CVE-2026-120059, CVE-2026-120060, CVE-2026-120061, CVE-2026-120062, CVE-2026-120063, CVE-2026-120064, CVE-2026-120065, CVE-2026-120066, CVE-2026-120067.
    • Referenced sources: PostgreSQL security release bulletin for psqlODBC (02 November 2026) and the psqlODBC GitHub Changelog (18.00.0006, 02 November 2026).

    Remediation

    • Upgrade PostgreSQL ODBC driver to version 18.00.0006 or later as described in the vendor security bulletin.