PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql | Sep 20, 2017 | Mar 31, 2014 |
| Centos_linux | — | Upgrade postgresql84-pythonUpgrade postgresql84-libsUpgrade postgresql84-serverUpgrade postgresql-tclUpgrade postgresql84-develUpgrade postgresql-plUpgrade postgresql84-plpythonUpgrade postgresql-pythonUpgrade postgresql84-docsUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql84-pltclUpgrade postgresql84-contribUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql84-plperlUpgrade postgresql84-tclUpgrade postgresql-plperlUpgrade postgresql84Upgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql84-testUpgrade postgresql-libs | Dec 1, 2016 | Mar 31, 2014 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | Feb 20, 2014 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server. | Oct 30, 2017 | Mar 31, 2014 |
| Oracle_linux | — | Upgrade postgresql84-plpythonUpgrade postgresql84-pltclUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql84-plperlUpgrade postgresql84-serverUpgrade postgresql84-pythonUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql84-testUpgrade postgresql84Upgrade postgresql84-tclUpgrade postgresql84-contribUpgrade postgresql84-docsUpgrade postgresql84-develUpgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-plpythonUpgrade postgresql84-libs | Oct 16, 2024 | Mar 28, 2014 |
| Postgres | — | Upgrade to PostgreSQL version 9.3.3 | Apr 1, 2014 | Mar 31, 2014 |
| Suse | — | Upgrade postgresql10-serverUpgrade libpq5-32bitUpgrade postgresql94-docsUpgrade postgresql91-docsUpgrade postgresql91-contribUpgrade postgresql10-develUpgrade postgresql93-develUpgrade postgresql91-develUpgrade postgresql10Upgrade postgresql10-docsUpgrade postgresql91-serverUpgrade postgresql94-contribUpgrade postgresql96-serverUpgrade postgresql93Upgrade postgresql10-plpythonUpgrade postgresql96-contribUpgrade postgresql10-plperlUpgrade postgresql10-contribUpgrade libecpg6Upgrade postgresql91Upgrade libpq5Upgrade postgresql96-docsUpgrade postgresql93-serverUpgrade postgresql96-develUpgrade postgresql96Upgrade postgresql10-pltclUpgrade postgresql94-develUpgrade postgresql93-contribUpgrade postgresql94Upgrade postgresql94-serverUpgrade postgresql93-docs | Dec 18, 2015 | Mar 28, 2014 |
| Ubuntu | — | Upgrade postgresql-9.1Upgrade postgresql-8.4 | Nov 8, 2024 | Mar 31, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub