PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql | Sep 20, 2017 | Mar 31, 2014 |
| Centos_linux | — | Upgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql84-testUpgrade postgresql-contribUpgrade postgresql84-tclUpgrade postgresql84-plperlUpgrade postgresql84-pltclUpgrade postgresql-plperlUpgrade postgresql84-contribUpgrade postgresql-develUpgrade postgresql84Upgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql84-develUpgrade postgresql84-libsUpgrade postgresql-tclUpgrade postgresql84-serverUpgrade postgresql84-docsUpgrade postgresql84-plpythonUpgrade postgresql-plpythonUpgrade postgresql-plUpgrade postgresql-pythonUpgrade postgresql84-python | Dec 1, 2016 | Mar 31, 2014 |
| Freebsd | — | Upgrade postgresql-server | Dec 10, 2025 | Feb 20, 2014 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server. | Oct 30, 2017 | Mar 31, 2014 |
| Oracle_linux | — | Upgrade postgresql84-tclUpgrade postgresql-docsUpgrade postgresql84-libsUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql84Upgrade postgresql84-testUpgrade postgresql84-contribUpgrade postgresql84-docsUpgrade postgresql84-develUpgrade postgresql-develUpgrade postgresql84-plpythonUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql84-pythonUpgrade postgresqlUpgrade postgresql84-plperlUpgrade postgresql84-pltclUpgrade postgresql84-serverUpgrade postgresql-plperl | Oct 16, 2024 | Mar 28, 2014 |
| Postgres | — | Upgrade to PostgreSQL version 9.3.3 | Apr 1, 2014 | Mar 31, 2014 |
| Suse | — | Upgrade postgresql91-develUpgrade postgresql10Upgrade postgresql10-serverUpgrade postgresql96-serverUpgrade postgresql93-develUpgrade postgresql91-contribUpgrade libpq5-32bitUpgrade postgresql94-contribUpgrade postgresql10-docsUpgrade postgresql94-docsUpgrade postgresql91-docsUpgrade postgresql93Upgrade postgresql10-develUpgrade postgresql91-serverUpgrade postgresql94Upgrade postgresql93-docsUpgrade postgresql96-develUpgrade libecpg6Upgrade postgresql96-contribUpgrade postgresql94-serverUpgrade postgresql93-serverUpgrade libpq5Upgrade postgresql10-pltclUpgrade postgresql94-develUpgrade postgresql93-contribUpgrade postgresql91Upgrade postgresql10-contribUpgrade postgresql10-plpythonUpgrade postgresql10-plperlUpgrade postgresql96-docsUpgrade postgresql96 | Dec 18, 2015 | Mar 28, 2014 |
| Ubuntu | — | Upgrade postgresql-8.4Upgrade postgresql-9.1 | Nov 8, 2024 | Mar 31, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub