It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Aug 24, 2020 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresql12Upgrade postgresql | Sep 23, 2020 | Aug 24, 2020 |
| Centos_linux | — | Upgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-contribUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-test-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-docsUpgrade postgresql-plperl-debuginfoUpgrade postgresqlUpgrade postgresql-serverUpgrade pgaudit-debugsourceUpgrade postgresql-pltclUpgrade pgauditUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-static | Sep 9, 2020 | Aug 24, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 27, 2020 | Aug 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresql-libs | Sep 29, 2020 | Aug 24, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-serverUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-staticUpgrade postgres-decoderbufsUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade pgauditUpgrade postgresqlUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql | Sep 10, 2020 | Aug 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.4 | Aug 17, 2020 | Aug 17, 2020 |
| Redhat_linux | — | Upgrade postgres-decoderbufsUpgrade postgresql-staticUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plperlUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-serverUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade pgauditUpgrade pgaudit-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade postgresqlUpgrade postgresql-pltclUpgrade pgaudit-debugsourceUpgrade postgresql-testUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-debugsource | Sep 9, 2020 | Aug 24, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pgauditUpgrade postgres-decoderbufsUpgrade pgaudit-debugsource | Mar 12, 2024 | Aug 24, 2020 |
| Suse | — | Upgrade postgresql10-docsUpgrade postgresql12-contribUpgrade postgresql12-serverUpgrade postgresql10-contribUpgrade postgresql12-pltclUpgrade postgresql-plpythonUpgrade postgresql96-pltclUpgrade libpq5-32bitUpgrade postgresql11-docsUpgrade postgresql-server-develUpgrade postgresql96Upgrade postgresql-develUpgrade postgresql96-serverUpgrade postgresql10Upgrade postgresql12-docsUpgrade postgresql-contribUpgrade postgresql10-develUpgrade postgresql11-plperlUpgrade postgresql11-server-develUpgrade libecpg6Upgrade postgresql-llvmjitUpgrade postgresql10-serverUpgrade postgresql11Upgrade postgresql12-plpythonUpgrade postgresql11-contribUpgrade postgresql12-plperlUpgrade postgresql11-pltclUpgrade postgresql12-server-develUpgrade postgresql-docsUpgrade postgresql10-pltclUpgrade libecpg6-32bitUpgrade postgresql11-plpythonUpgrade postgresql96-develUpgrade postgresql12Upgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql96-plpythonUpgrade postgresql96-plperlUpgrade postgresql11-serverUpgrade postgresql96-docsUpgrade postgresql96-contribUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql12-llvmjitUpgrade postgresql10-plpythonUpgrade postgresql-testUpgrade postgresql12-develUpgrade postgresql11-testUpgrade postgresql12-testUpgrade libpq5Upgrade postgresql10-testUpgrade postgresql11-llvmjitUpgrade postgresql11-develUpgrade postgresql96-testUpgrade postgresql10-plperl | Aug 18, 2020 | Aug 17, 2020 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-12Upgrade postgresql-9.5 | Aug 26, 2020 | Aug 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub