CVE-2012-1618
Unescaped parameters in the PostgreSQL JDBC driver
Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.
Exploit likelihood
What each source reports
NVD Score used
Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.
- Record
CVE-2012-1618- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.
- Record
CVE-2012-1618- Updated
- 2026-11-02
EUVDEUVD-2022-4105 No score
Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.
- Record
EUVD-2022-4105- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h86w-m5rm-xr33 No score
Unescaped parameters in the PostgreSQL JDBC driver
Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.
- Record
GHSA-h86w-m5rm-xr33- Updated
- 2026-11-02
OSVGHSA-h86w-m5rm-xr33 No score
Unescaped parameters in the PostgreSQL JDBC driver
Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.
- Record
GHSA-h86w-m5rm-xr33- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.postgresql:postgresqlMaven |
before 8.2 | 8.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-1618 is a high vulnerability (CVSS 7.5) in Postgresql, published October 6, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.94%, the 87th percentile. Fixed in org.postgresql:postgresql 8.2.
References
openwall.com/lists/oss-security/2012/03/30/9
bugzilla.novell.com/show_bug.cgi?id=754273
osvdb.org/80641
lists.opensuse.org/opensuse-security/2012-03/msg00024.html
Show 9 moreShow less
archives.neohapsis.com/archives/bugtraq/2012-03/0126.html
nvd.nist.gov/vuln/detail/CVE-2012-1618
github.com/advisories/GHSA-h86w-m5rm-xr33