It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Aug 24, 2020 |
| Alpine Linux | — | Upgrade postgresql12Upgrade postgresqlUpgrade postgresql14Upgrade postgresql15 | Sep 23, 2020 | Aug 24, 2020 |
| Centos_linux | — | Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-contribUpgrade postgresql-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpython3Upgrade pgaudit-debuginfoUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-testUpgrade pgaudit-debugsourceUpgrade pgauditUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgresql-server-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-debuginfo | Sep 9, 2020 | Aug 24, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 27, 2020 | Aug 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-devel | Sep 29, 2020 | Aug 24, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-staticUpgrade postgresqlUpgrade rh-postgresql10-postgresql-pltclUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade pgauditUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresqlUpgrade postgresql-server-devel | Sep 10, 2020 | Aug 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.4 | Aug 17, 2020 | Aug 17, 2020 |
| Redhat_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-testUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-develUpgrade postgresqlUpgrade postgresql-upgrade-develUpgrade pgaudit-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-upgradeUpgrade pgauditUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-docsUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-staticUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-serverUpgrade postgresql-plperl-debuginfoUpgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade postgresql-plperlUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-debuginfo | Sep 9, 2020 | Aug 24, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debugsource | Mar 12, 2024 | Aug 24, 2020 |
| Suse | — | Upgrade postgresql10-plpythonUpgrade postgresql11-testUpgrade postgresql12-plperlUpgrade postgresql12-server-develUpgrade postgresql11-pltclUpgrade postgresql10-pltclUpgrade postgresql12Upgrade postgresql11-serverUpgrade postgresql96-testUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql96-plpythonUpgrade postgresql96-plperlUpgrade postgresql10-plperlUpgrade postgresql96-contribUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql96-docsUpgrade postgresql-testUpgrade postgresql12-llvmjitUpgrade postgresql12-develUpgrade postgresql12-testUpgrade postgresql96-develUpgrade libpq5Upgrade postgresql11Upgrade postgresql11-develUpgrade libecpg6-32bitUpgrade postgresql10-testUpgrade postgresql11-plpythonUpgrade postgresql11-contribUpgrade postgresql-docsUpgrade postgresql11-llvmjitUpgrade postgresql12-plpythonUpgrade postgresql10-serverUpgrade postgresql-llvmjitUpgrade postgresql12-pltclUpgrade postgresql96Upgrade libecpg6Upgrade postgresql10-develUpgrade postgresql-plpythonUpgrade postgresql-server-develUpgrade postgresql10-contribUpgrade postgresql12-contribUpgrade postgresql11-plperlUpgrade postgresql96-pltclUpgrade postgresql-contribUpgrade postgresql10Upgrade postgresql12-serverUpgrade postgresql12-docsUpgrade postgresql96-serverUpgrade postgresql11-server-develUpgrade postgresql10-docsUpgrade libpq5-32bitUpgrade postgresql-develUpgrade postgresql11-docs | Aug 18, 2020 | Aug 17, 2020 |
| Ubuntu | — | Upgrade postgresql-12Upgrade postgresql-9.5Upgrade postgresql-10 | Aug 26, 2020 | Aug 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub