Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

yandex-qatools/postgresql-embedded

              master @ 7ed616e
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Information Disclosure / Privilege Escalation: 1 prior fix. Scrutinize any change in this area.

src/main/java/ru/yandex/qatools/embed/postgresql/distribution/Version.java: most-fixed (6 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Embedded PostgreSQL versions prior to 11.1/10.6/9.6.11/9.5.15 are vulnerable to CVE-2018-16850, a SQL injection in pg_dump and pg_upgrade. Since the project executes these binaries, any consumer using an unpatched version is exposed.

Missing Authorization / Information Disclosure: Versions before 10.5/9.6.10/9.5.14 are vulnerable to CVE-2018-10915 (connection parameter security bypass) and CVE-2018-10925 (memory disclosure and missing authorization), exposing sensitive data and allowing unauthorized access.

Privilege Escalation: Versions before 10.4/9.6.9/9.5.13 are vulnerable to CVE-2018-1115, a too-permissive ACL on pg_logfile_rotate() that allows unprivileged users to rotate log files, potentially leading to privilege escalation.