A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade pg_repackUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-plperlUpgrade postgres-decoderbufsUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresqlUpgrade pgauditUpgrade postgresql-serverUpgrade postgresql-docs | Jun 7, 2022 | May 30, 2022 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql14Upgrade postgresql12Upgrade postgresql13Upgrade postgresql15 | Aug 22, 2024 | Aug 31, 2022 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-plpython2Upgrade postgresql-develUpgrade postgresql-debuginfoUpgrade postgresql-server-develUpgrade postgresql-llvmjitUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpythonUpgrade libpq-debuginfoUpgrade postgresql-staticUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-private-develUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-libsUpgrade libpqUpgrade postgresql-docsUpgrade libpq-develUpgrade postgresqlUpgrade postgresql-private-libs | Sep 30, 2022 | Aug 31, 2022 |
| Centos_linux | — | Upgrade postgresql-testUpgrade postgresql-server-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-plpythonUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresqlUpgrade postgresql-staticUpgrade postgresql-pltclUpgrade postgresql-debugsourceUpgrade postgresql-serverUpgrade postgresql-docsUpgrade pg_repackUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-develUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pg_repack-debugsource | May 31, 2022 | May 30, 2022 |
| Debian | — | Upgrade postgresql-13 | May 16, 2022 | May 16, 2022 |
| Freebsd | — | Upgrade postgresql13-serverUpgrade postgresql14-serverUpgrade postgresql11-serverUpgrade postgresql12-serverUpgrade postgresql10-server | Nov 4, 2022 | May 11, 2022 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Nov 23, 2022 | Aug 31, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-devel | Oct 28, 2022 | Aug 31, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-test | Aug 18, 2022 | Aug 16, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-testUpgrade postgresql-develUpgrade postgresql-contrib | Aug 18, 2022 | Aug 16, 2022 |
| Oracle_linux | — | Upgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade pg_repackUpgrade postgresql-private-libsUpgrade postgresql-plpython3Upgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-upgrade-develUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade postgresql-plpythonUpgrade pgauditUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgres-decoderbufs | Jun 2, 2022 | May 12, 2022 |
| Postgres | — | Upgrade to PostgreSQL version 14.3 | Aug 31, 2022 | Aug 31, 2022 |
| Redhat_linux | — | Upgrade postgresql-docs-debuginfoUpgrade pgaudit-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-private-libsUpgrade postgresql-plpythonUpgrade postgresql-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade pg_repackUpgrade postgresql-upgradeUpgrade postgresql-private-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-server-devel-debuginfoUpgrade postgresql-plperlUpgrade pgaudit-debuginfoUpgrade postgresql-pltclUpgrade postgresql-private-libs-debuginfoNo solution existsUpgrade postgresql-upgrade-develUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-contrib-debuginfoUpgrade pgauditUpgrade postgresql-debugsourceUpgrade postgresql-testUpgrade pg_repack-debugsourceUpgrade postgresql-libsUpgrade postgres-decoderbufs-debugsourceUpgrade postgres-decoderbufsUpgrade postgresql-test-debuginfoUpgrade postgresql-staticUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpython3-debuginfo | May 31, 2022 | May 30, 2022 |
| Rocky_linux | — | Upgrade pg_repack-debugsourceUpgrade pgauditUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-staticUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade postgres-decoderbufsUpgrade postgresql-server-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-serverUpgrade postgresql-upgrade-develUpgrade postgresql-testUpgrade postgresql-test-debuginfoUpgrade postgresql-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-pltcl-debuginfoUpgrade pg_repackUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-contribUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-develUpgrade postgresql-pltcl | Mar 12, 2024 | Aug 31, 2022 |
| Suse | — | Upgrade postgresql13-server-develUpgrade libpq5Upgrade postgresql12-server-develUpgrade libecpg6-32bitUpgrade postgresql-server-develUpgrade postgresql13-llvmjit-develUpgrade postgresql13-pltclUpgrade postgresql10-pltclUpgrade postgresql13-contribUpgrade postgresql10-plpythonUpgrade postgresql14-server-develUpgrade postgresql12Upgrade postgresql12-llvmjitUpgrade postgresql14-pltclUpgrade postgresql14-testUpgrade postgresql10-contribUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql12-plpythonUpgrade postgresql14-llvmjit-develUpgrade libecpg6Upgrade postgresql-plpythonUpgrade postgresql10-llvmjit-develUpgrade postgresql12-testUpgrade postgresql12-llvmjit-develUpgrade postgresql10-plperlUpgrade postgresql14-serverUpgrade postgresql12-plperlUpgrade postgresql13-develUpgrade postgresql10-testUpgrade postgresql14-docsUpgrade postgresql12-develUpgrade postgresqlUpgrade postgresql14Upgrade postgresql13-serverUpgrade postgresql14-plperlUpgrade postgresql-contribUpgrade postgresql10Upgrade postgresql14-contribUpgrade postgresql14-plpythonUpgrade postgresql10-docsUpgrade postgresql-docsUpgrade postgresql13-testUpgrade postgresql12-serverUpgrade postgresql13-llvmjitUpgrade postgresql10-develUpgrade libpq5-32bitUpgrade postgresql14-llvmjitUpgrade postgresql13-plpythonUpgrade postgresql12-contribUpgrade postgresql10-serverUpgrade postgresql-pltclUpgrade postgresql13-plperlUpgrade postgresql14-develUpgrade postgresql12-docs | Oct 26, 2022 | Aug 31, 2022 |
| Ubuntu | — | Upgrade postgresql-9.5 (Ubuntu Pro)Upgrade postgresql-13Upgrade postgresql-10Upgrade postgresql-12Upgrade postgresql-14 | May 25, 2022 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub