Atualiza\u00e7\u00f5es corretivas foram formuladas para todas as vers\u00f5es suportadas do PostgreSQL 17.3, 16.7, 15.11, 14.16 e 13.19, corrigindo mais de 70 erros e eliminando uma vulnerabilidade (CVE-2025-1094), que foi explorada no final de dezembro em um ataque \u00e0 empresa BeyondTrust e ao Minist\u00e9rio das Finan\u00e7as dos EUA. O problema no PostgreSQL foi identificado ao analisar uma vulnerabilidade remota (CVE-2024-12356) nos servi\u00e7os BeyondTrust PRA (Privileged Remote Access) e BeyondTrust RS (Remote Support), na qual uma vulnerabilidade 0-day previamente desconhecida na libpq tamb\u00e9m foi utilizada. <\/p>\n
Como resultado do ataque, os agressores conseguiram obter a chave de acesso \u00e0 API utilizada para fornecer suporte t\u00e9cnico remoto aos clientes dos servi\u00e7os SaaS da BeyondTrust. Essa API foi usada para redefinir senhas e comprometer a infraestrutura do Minist\u00e9rio das Finan\u00e7as dos EUA, que utiliza produtos da BeyondTrust. Durante o ataque, os criminosos conseguiram baixar documentos confidenciais e tiveram acesso \u00e0s esta\u00e7\u00f5es de trabalho dos funcion\u00e1rios do minist\u00e9rio. <\/p>\n
A vulnerabilidade ocorre na biblioteca libpq, que fornece uma API para intera\u00e7\u00e3o com o SGBD a partir de programas em C (tamb\u00e9m existem bibliotecas de v\u00ednculo para C++, Perl, PHP e Python). O problema afeta aplicativos que usam as fun\u00e7\u00f5es PQescapeLiteral(), PQescapeIdentifier(), PQescapeString() ou PQescapeStringConn() para escapar de caracteres especiais e neutralizar aspas. <\/p>\n
O atacante pode conseguir injetar seu pr\u00f3prio c\u00f3digo SQL se o texto recebido externamente for escapado usando as fun\u00e7\u00f5es mencionadas da libpq antes de ser usado dentro da consulta SQL. Nos aplicativos da BeyondTrust, as consultas escapadas dessa forma foram passadas atrav\u00e9s da ferramenta de linha de comando psql. A vulnerabilidade \u00e9 causada pela falta de verifica\u00e7\u00e3o da validade dos caracteres Unicode utilizados no texto nas fun\u00e7\u00f5es de escape, permitindo contornar a normaliza\u00e7\u00e3o das aspas por meio da especifica\u00e7\u00e3o de sequ\u00eancias multibyte UTF-8 incorretas. <\/p>\n
Para explorar a vulnerabilidade, pode-se usar um caractere UTF-8 incorreto, composto pelos bytes 0xC0 e 0x27 (\u2514'). O byte 0x27 na codifica\u00e7\u00e3o ASCII corresponde a uma aspa simples ('), que deve ser escapada. No c\u00f3digo de escape, a combina\u00e7\u00e3o de bytes 0xC0 e 0x27 \u00e9 tratada como um \u00fanico caractere Unicode. Consequentemente, o byte 0x27 nessa sequ\u00eancia permanece n\u00e3o escapado, enquanto ao processar a consulta SQL na ferramenta psql ele \u00e9 tratado como uma aspa. <\/p>\n
Ao executar consultas SQL<\/a> Utilizando a ferramenta psql para organizar a execu\u00e7\u00e3o de c\u00f3digo arbitr\u00e1rio, pode-se usar a substitui\u00e7\u00e3o na string de comando \\\\!\\\", destinada na psql para executar programas arbitr\u00e1rios. Por exemplo, para iniciar, em servidor<\/a> a ferramenta \"id\" pode-se passar o valor \"hax\\xC0\u2032; \\\\! id #\". No exemplo abaixo, um script PHP chamado dbquote \u00e9 chamado para escapar, utilizando a fun\u00e7\u00e3o PHP pg_escape_string, que trabalha sobre a fun\u00e7\u00e3o PQescapeString da libpq: $ echo -e 'hello \\xC0\u2019world' | .\/dbquote 'hello \u2514\u2019world' $ quoted=$(echo -e 'hax\\xC0\u2032; \\\\! id # ' | .\/dbquote) $ echo 'SELECT COUNT(1) FROM gw_sessions WHERE session_key = $quoted AND session_type = 'sdcust' AND (expiration IS NULL OR expiration>NOW())' | psql -e SELECT COUNT(1) FROM gw_sessions WHERE session_key = 'hax\u2514'; ERROR: byte sequence inv\u00e1lido para codifica\u00e7\u00e3o 'UTF8': 0xc0 0x27 uid=1000(myexamplecompany) gid=1000(myexamplecompany) \u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.3, 16.7, 15.11, 14.16 \u0438 13.19, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 70 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-1094), \u0432 \u043a\u043e\u043d\u0446\u0435 \u0434\u0435\u043a\u0430\u0431\u0440\u044f \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0432 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e BeyondTrust \u0438 \u041c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u043e \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432 \u0421\u0428\u0410. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 PostgreSQL \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2024-12356) \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445 BeyondTrust PRA (Privileged Remote Access) \u0438 BeyondTrust […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121960","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A vulnerabilidade utilizada em um ataque \u00e0 BeyondTrust foi corrigida no PostgreSQL | ProHoster","description":"Foram formadas atualiza\u00e7\u00f5es corretivas para todos os ramos suportados do PostgreSQL 17.3, 16.7, 15.11, 14.16 e 13.19, nas quais mais de 70 erros foram corrigidos e uma vulnerabilidade (CVE-2025-1094) foi solucionada, no final de dezembro.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 PostgreSQL \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043f\u0440\u0438 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 BeyondTrust | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.3, 16.7, 15.11, 14.16 \u0438 13.19, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 70 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-1094), \u0432 \u043a\u043e\u043d\u0446\u0435 \u0434\u0435\u043a\u0430\u0431\u0440\u044f.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-16T18:22:05+00:00","article:modified_time":"2025-02-16T18:22:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121960","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:39:20","updated":"2026-02-09 22:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/121960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=121960"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/121960\/revisions"}],"predecessor-version":[{"id":160023,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/121960\/revisions\/160023"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=121960"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=121960"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=121960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"