A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Mar 17, 2020 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresqlUpgrade postgresql12 | Aug 22, 2024 | Mar 17, 2020 |
| Amazon_linux | — | Upgrade postgresql96 | Oct 28, 2020 | Feb 18, 2020 |
| Centos_linux | — | Upgrade postgresql-docs-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade pgaudit-debugsourceUpgrade postgresql-testUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade postgresql-test-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade postgresql-upgradeUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plpython3Upgrade pgaudit-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade postgresql-server-develUpgrade postgresql-upgrade-devel-debuginfo | Sep 9, 2020 | Mar 17, 2020 |
| Debian | — | Upgrade postgresql-11 | Feb 18, 2020 | Feb 18, 2020 |
| Freebsd | — | Upgrade postgresql96-serverUpgrade postgresql10-serverUpgrade postgresql11-serverUpgrade postgresql12-server | Mar 30, 2020 | Mar 29, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Mar 12, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-devel | May 27, 2020 | Mar 17, 2020 |
| Oracle_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgres-decoderbufsUpgrade rh-postgresql10-postgresql-testUpgrade pgauditUpgrade rh-postgresql10-postgresql-docsUpgrade postgresqlUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-staticUpgrade postgresql-test | Sep 10, 2020 | Feb 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.2 | Feb 14, 2020 | Feb 14, 2020 |
| Redhat_linux | — | Upgrade pgaudit-debuginfoUpgrade pgauditUpgrade postgresql-staticUpgrade postgresql-debuginfoUpgrade postgresql-upgradeUpgrade postgres-decoderbufsUpgrade postgresql-contribUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade postgresql-test-debuginfoUpgrade postgresql-server-develUpgrade postgresql-server-debuginfoUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-docs-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-plpython3 | Sep 9, 2020 | Mar 17, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debuginfo | Mar 12, 2024 | Mar 17, 2020 |
| Suse | — | Upgrade postgresql12-pltclUpgrade postgresql-docsUpgrade postgresql10-serverUpgrade postgresql12-llvmjitUpgrade postgresql-testUpgrade postgresql96Upgrade postgresql10Upgrade postgresql96-serverUpgrade postgresqlUpgrade postgresql12-server-develUpgrade postgresql12-serverUpgrade postgresql96-plperlUpgrade postgresql96-testUpgrade postgresql-serverUpgrade libpq5-32bitUpgrade postgresql10-plperlUpgrade postgresql12-contribUpgrade postgresql12-docsUpgrade libecpg6-32bitUpgrade postgresql10-testUpgrade libpq5Upgrade postgresql12-develUpgrade postgresql-llvmjitUpgrade postgresql-pltclUpgrade postgresql12Upgrade postgresql12-testUpgrade postgresql96-plpythonUpgrade postgresql96-pltclUpgrade postgresql10-pltclUpgrade postgresql96-docsUpgrade postgresql-contribUpgrade postgresql12-plperlUpgrade postgresql10-contribUpgrade postgresql10-plpythonUpgrade postgresql96-contribUpgrade postgresql-develUpgrade postgresql-server-develUpgrade postgresql96-develUpgrade postgresql10-docsUpgrade postgresql12-plpythonUpgrade postgresql10-develUpgrade python3-psycopg2Upgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade libecpg6 | Mar 5, 2020 | Feb 18, 2020 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-11 | Feb 19, 2020 | Feb 18, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub