It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Aug 24, 2020 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql14Upgrade postgresql12Upgrade postgresql | Sep 23, 2020 | Aug 24, 2020 |
| Centos_linux | — | Upgrade pgaudit-debugsourceUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-upgrade-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-plperl-debuginfoUpgrade postgresql-debuginfoUpgrade pgauditUpgrade postgresql-serverUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade postgresql-plpython3-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-test-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3 | Sep 9, 2020 | Aug 24, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 27, 2020 | Aug 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-devel | Sep 29, 2020 | Aug 24, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-contribUpgrade postgresql-testUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-serverUpgrade postgres-decoderbufsUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-docsUpgrade pgauditUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-static | Sep 10, 2020 | Aug 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.4 | Aug 17, 2020 | Aug 17, 2020 |
| Redhat_linux | — | Upgrade postgres-decoderbufsUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgauditUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-docsUpgrade postgresql-plperl-debuginfoUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-staticUpgrade postgresql-debugsourceUpgrade postgresql-test-rpm-macrosUpgrade postgresql-testUpgrade pgaudit-debugsourceUpgrade postgresql-pltclUpgrade postgresql-upgradeUpgrade postgresql-docs-debuginfoUpgrade postgresqlUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-server-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade pgaudit-debuginfo | Sep 9, 2020 | Aug 24, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfoUpgrade pgaudit-debugsourceUpgrade pgauditUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufs | Mar 12, 2024 | Aug 24, 2020 |
| Suse | — | Upgrade postgresql10-develUpgrade postgresql12-pltclUpgrade postgresql12-contribUpgrade postgresql96-serverUpgrade postgresql12-docsUpgrade postgresql10-contribUpgrade postgresql96-pltclUpgrade postgresql-server-develUpgrade postgresql10-serverUpgrade postgresql10Upgrade postgresql12-serverUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade libpq5-32bitUpgrade postgresql11-docsUpgrade postgresql96Upgrade postgresql11-plperlUpgrade postgresql-llvmjitUpgrade postgresql10-docsUpgrade libecpg6Upgrade postgresql11-server-develUpgrade libecpg6-32bitUpgrade postgresql11-develUpgrade postgresql11-contribUpgrade postgresql12-plperlUpgrade postgresql12-llvmjitUpgrade postgresql11Upgrade postgresql11-llvmjitUpgrade postgresql-pltclUpgrade postgresql-testUpgrade postgresql11-pltclUpgrade postgresql-serverUpgrade postgresql11-serverUpgrade postgresql12-develUpgrade postgresqlUpgrade postgresql96-plpythonUpgrade postgresql10-pltclUpgrade libpq5Upgrade postgresql96-plperlUpgrade postgresql-plperlUpgrade postgresql10-plperlUpgrade postgresql12Upgrade postgresql12-server-develUpgrade postgresql96-docsUpgrade postgresql11-plpythonUpgrade postgresql-docsUpgrade postgresql12-plpythonUpgrade postgresql96-develUpgrade postgresql96-contribUpgrade postgresql96-testUpgrade postgresql10-testUpgrade postgresql11-testUpgrade postgresql12-testUpgrade postgresql10-plpython | Aug 18, 2020 | Aug 17, 2020 |
| Ubuntu | — | Upgrade postgresql-12Upgrade postgresql-9.5Upgrade postgresql-10 | Aug 26, 2020 | Aug 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub