It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Aug 24, 2020 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresqlUpgrade postgresql12 | Sep 23, 2020 | Aug 24, 2020 |
| Centos_linux | — | Upgrade postgresql-plperlUpgrade postgresql-staticUpgrade postgresql-debuginfoUpgrade postgresqlUpgrade postgresql-testUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade pgauditUpgrade pgaudit-debugsourceUpgrade postgresql-pltclUpgrade postgresql-server-debuginfoUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-plperl-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-upgrade-devel-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade postgresql-docs-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-upgrade | Sep 9, 2020 | Aug 24, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 27, 2020 | Aug 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql-plperl | Sep 29, 2020 | Aug 24, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-staticUpgrade postgres-decoderbufsUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade pgauditUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresqlUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-testUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-server | Sep 10, 2020 | Aug 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.4 | Aug 17, 2020 | Aug 17, 2020 |
| Redhat_linux | — | Upgrade postgresql-upgradeUpgrade pgaudit-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-pltclUpgrade postgresql-testUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-debugsourceUpgrade postgresql-plpython3Upgrade postgresqlUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-develUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-staticUpgrade pgauditUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperlUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-plperl-debuginfoUpgrade postgresql-test-debuginfo | Sep 9, 2020 | Aug 24, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufsUpgrade pgaudit-debugsourceUpgrade pgauditUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfo | Mar 12, 2024 | Aug 24, 2020 |
| Suse | — | Upgrade postgresql10-testUpgrade postgresql12-llvmjitUpgrade postgresql12-testUpgrade postgresql12-develUpgrade postgresql12-server-develUpgrade postgresql11-llvmjitUpgrade postgresql12-plpythonUpgrade postgresql96-develUpgrade postgresql-serverUpgrade postgresql12-plperlUpgrade postgresql11-testUpgrade postgresql96-plperlUpgrade postgresql-plperlUpgrade postgresql10-plpythonUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql10-plperlUpgrade postgresql-pltclUpgrade postgresql10-pltclUpgrade postgresql11-plpythonUpgrade libecpg6-32bitUpgrade postgresql11-contribUpgrade postgresql11Upgrade postgresql11-pltclUpgrade postgresql96-testUpgrade libpq5Upgrade postgresql96-contribUpgrade postgresql-docsUpgrade postgresql11-serverUpgrade postgresql11-develUpgrade postgresql96-docsUpgrade postgresql12Upgrade postgresql96-plpythonUpgrade postgresql10-contribUpgrade postgresql12-pltclUpgrade postgresql96-pltclUpgrade postgresql10Upgrade postgresql96-serverUpgrade postgresql12-serverUpgrade postgresql10-develUpgrade postgresql12-docsUpgrade postgresql-server-develUpgrade postgresql11-docsUpgrade postgresql-develUpgrade libpq5-32bitUpgrade postgresql11-plperlUpgrade postgresql10-serverUpgrade postgresql11-server-develUpgrade postgresql-plpythonUpgrade postgresql-llvmjitUpgrade postgresql-contribUpgrade postgresql96Upgrade libecpg6Upgrade postgresql10-docsUpgrade postgresql12-contrib | Aug 18, 2020 | Aug 17, 2020 |
| Ubuntu | — | Upgrade postgresql-12Upgrade postgresql-10Upgrade postgresql-9.5 | Aug 26, 2020 | Aug 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub