CVE-2013-1899
Mediumpostgresql: Insecure switch parsing
Published Apr 4, 2013 · Updated Mar 9, 2026 · Also known as DEBIAN-CVE-2013-1899, DEBIAN-CVE-2013-1901, DSA-2658-1
Key Facts
Patch immediately- CVE-2013-1899 is a medium-severity vulnerability (CVSS 6.5 v2) affecting Postgresql, Ubuntu Linux (Canonical), postgresql-9.1 (debian) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 54% probability of exploitation in the next 30 days.
- Fixed versions are available, including cfme 0:5.2.0.37-1.el6cf, cfme-vnc-plugin 0:1.0.0-2.el6cf, libdnet 0:1.12-11.el6cf.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
6.5
AV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS (30-day exploit likelihood)
54%
Higher than 99.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2013-1899 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a "-" (hyphen).
Affected Products
265 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| PostgresqlPostgresql | 9.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.2, 9.0.3, 9.0.4 | n/a |
| Ubuntu LinuxCanonical | 10.04, 11.10, 12.04, 12.10, 8.04 | n/a |
| postgresql-9.1debian | See advisory | 9.1.9-0wheezy1 |
| postgresql9-contribamazon | See advisory | 9.2.4-1.35.amzn1 |
| postgresql9-develamazon | See advisory | 9.2.4-1.35.amzn1 |
Patched Releases
cfme
0:5.2.0.37-1.el6cf
cfme-vnc-plugin
0:1.0.0-2.el6cf
libdnet
0:1.12-11.el6cf
libecpg6
9.5.4-1.2
libecpg6-32bit
9.5.4-1.2
libpq5
9.5.4-1.2
libpq5-32bit
9.5.4-1.2
lshw
0:B.02.16-4.el6cf
netapp-manageability-sdk
0:4.0P1-3.el6cf
open-vm-tools
0:9.2.3-5.el6cf
postgresql-9.1
9.1.9-0wheezy1
postgresql9
9.2.4-1.35.amzn1
postgresql9-contrib
9.2.4-1.35.amzn1
postgresql9-devel
9.2.4-1.35.amzn1
postgresql9-docs
9.2.4-1.35.amzn1
postgresql9-libs
9.2.4-1.35.amzn1
postgresql9-plperl
9.2.4-1.35.amzn1
postgresql9-plpython
9.2.4-1.35.amzn1
postgresql9-pltcl
9.2.4-1.35.amzn1
postgresql9-server
9.2.4-1.35.amzn1
postgresql9-test
9.2.4-1.35.amzn1
postgresql9-upgrade
9.2.4-1.35.amzn1
postgresql92
0:1-12.el6
postgresql92-postgresql
0:9.2.4-7.el6
postgresql93
9.3.15-1.1
Timeline
Publicly disclosed
Apr 4, 2013
Last updated
Mar 9, 2026
Weakness Type
- CWE-94 Improper Control of Generation of Code ('Code Injection')
References
- advisoryRHEA-2013:1487
- advisoryhttp://www.postgresql.org/about/news/1456/
- advisoryhttp://www.postgresql.org/support/security/faq/2013-04-04/
- otherAPPLE-SA-2013-09-12-1
- otherAPPLE-SA-2013-09-17-1
FAQ
Common Questions.
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a data…
Affected: Postgresql versions 9.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.2, 9.0.3, 9.0.4; Ubuntu Linux (Canonical) versions 10.04, 11.10, 12.04, 12.10, 8.04; postgresql-9.1 (debian), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including cfme 0:5.2.0.37-1.el6cf, cfme-vnc-plugin 0:1.0.0-2.el6cf, libdnet 0:1.12-11.el6cf.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2013-1899 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo