It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Aug 24, 2020 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql14Upgrade postgresqlUpgrade postgresql12 | Sep 23, 2020 | Aug 24, 2020 |
| Centos_linux | — | Upgrade postgresql-testUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade postgresql-staticUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-serverUpgrade postgresql-plperl-debuginfoUpgrade pgauditUpgrade postgresql-plperlUpgrade postgresql-docsUpgrade pgaudit-debugsourceUpgrade postgresql-pltclUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufsUpgrade postgresql-test-debuginfo | Sep 9, 2020 | Aug 24, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 27, 2020 | Aug 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-plpythonUpgrade postgresql-server | Sep 29, 2020 | Aug 24, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-docsUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-syspathsUpgrade pgauditUpgrade postgres-decoderbufsUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-testUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresqlUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-plpython3Upgrade postgresql-pltcl | Sep 10, 2020 | Aug 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.4 | Aug 17, 2020 | Aug 17, 2020 |
| Redhat_linux | — | Upgrade postgresql-docs-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-plperlUpgrade postgresql-staticUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-serverUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-docsUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-pltclUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-develUpgrade postgresql-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-server-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-upgrade-develUpgrade postgresqlUpgrade postgres-decoderbufs-debugsource | Sep 9, 2020 | Aug 24, 2020 |
| Rocky_linux | — | Upgrade pgauditUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufsUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debugsource | Mar 12, 2024 | Aug 24, 2020 |
| Suse | — | Upgrade postgresql12-llvmjitUpgrade postgresql-docsUpgrade postgresql12Upgrade libecpg6-32bitUpgrade postgresql12-plperlUpgrade postgresql11-develUpgrade postgresql11-plpythonUpgrade postgresql96-contribUpgrade postgresql-testUpgrade postgresql11-serverUpgrade postgresql10-plpythonUpgrade postgresql11-testUpgrade postgresql12-testUpgrade postgresql10-testUpgrade postgresql12-develUpgrade postgresql12-server-develUpgrade postgresql11-contribUpgrade postgresqlUpgrade postgresql96-docsUpgrade libpq5Upgrade postgresql11Upgrade postgresql11-pltclUpgrade postgresql96-plperlUpgrade postgresql-serverUpgrade postgresql96-develUpgrade postgresql96-plpythonUpgrade postgresql11-llvmjitUpgrade postgresql12-plpythonUpgrade postgresql10-plperlUpgrade postgresql96-testUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql10-pltclUpgrade postgresql-server-develUpgrade postgresql11-docsUpgrade postgresql-develUpgrade libpq5-32bitUpgrade postgresql11-server-develUpgrade postgresql10-docsUpgrade postgresql12-contribUpgrade postgresql96-pltclUpgrade postgresql10-contribUpgrade postgresql12-pltclUpgrade postgresql10-serverUpgrade postgresql-plpythonUpgrade postgresql96-serverUpgrade postgresql10-develUpgrade postgresql10Upgrade postgresql-llvmjitUpgrade libecpg6Upgrade postgresql12-docsUpgrade postgresql12-serverUpgrade postgresql11-plperlUpgrade postgresql-contribUpgrade postgresql96 | Aug 18, 2020 | Aug 17, 2020 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-12Upgrade postgresql-10 | Aug 26, 2020 | Aug 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub