It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Aug 24, 2020 |
| Alpine Linux | — | Upgrade postgresql12Upgrade postgresqlUpgrade postgresql15Upgrade postgresql14 | Sep 23, 2020 | Aug 24, 2020 |
| Centos_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade pgaudit-debugsourceUpgrade postgresql-docsUpgrade pgauditUpgrade postgresql-testUpgrade postgresql-server-debuginfoUpgrade postgresql-serverUpgrade postgresql-plperl-debuginfoUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-upgrade-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-staticUpgrade postgresql-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade postgresql-upgrade-develUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade pgaudit-debuginfo | Sep 9, 2020 | Aug 24, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 27, 2020 | Aug 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-plperl | Sep 29, 2020 | Aug 24, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-upgrade-develUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-libsUpgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-testUpgrade pgauditUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresqlUpgrade postgres-decoderbufsUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-docs | Sep 10, 2020 | Aug 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.4 | Aug 17, 2020 | Aug 17, 2020 |
| Redhat_linux | — | Upgrade postgres-decoderbufsUpgrade postgresql-pltcl-debuginfoUpgrade pgauditUpgrade postgresql-plperlUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-serverUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-docsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-server-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-testUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresqlUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3Upgrade pgaudit-debugsourceUpgrade postgresql-server-devel | Sep 9, 2020 | Aug 24, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufsUpgrade pgauditUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debugsource | Mar 12, 2024 | Aug 24, 2020 |
| Suse | — | Upgrade postgresql12-serverUpgrade postgresql11-server-develUpgrade postgresql12-docsUpgrade postgresql-plpythonUpgrade postgresql12-pltclUpgrade postgresql96-pltclUpgrade postgresql96-serverUpgrade postgresql10Upgrade postgresql-server-develUpgrade libpq5-32bitUpgrade postgresql11-docsUpgrade postgresql10-serverUpgrade postgresql10-develUpgrade libecpg6Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql10-docsUpgrade postgresql-llvmjitUpgrade postgresql96Upgrade postgresql12-contribUpgrade postgresql10-contribUpgrade postgresql11-plperlUpgrade postgresql12-plperlUpgrade postgresql12-server-develUpgrade postgresql12-plpythonUpgrade postgresql96-develUpgrade postgresql11-plpythonUpgrade postgresql11-llvmjitUpgrade postgresql11Upgrade libpq5Upgrade libecpg6-32bitUpgrade postgresql10-plperlUpgrade postgresql10-plpythonUpgrade postgresql10-testUpgrade postgresql11-contribUpgrade postgresql11-testUpgrade postgresql-docsUpgrade postgresql12-testUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-testUpgrade postgresql96-plpythonUpgrade postgresql96-plperlUpgrade postgresql-plperlUpgrade postgresql96-docsUpgrade postgresql11-develUpgrade postgresql12Upgrade postgresql11-serverUpgrade postgresql12-llvmjitUpgrade postgresqlUpgrade postgresql12-develUpgrade postgresql96-contribUpgrade postgresql96-testUpgrade postgresql11-pltclUpgrade postgresql10-pltcl | Aug 18, 2020 | Aug 17, 2020 |
| Ubuntu | — | Upgrade postgresql-12Upgrade postgresql-10Upgrade postgresql-9.5 | Aug 26, 2020 | Aug 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub