It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Aug 24, 2020 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresqlUpgrade postgresql12 | Sep 23, 2020 | Aug 24, 2020 |
| Centos_linux | — | Upgrade pgaudit-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-develUpgrade postgresql-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-plperl-debuginfoUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade pgauditUpgrade pgaudit-debugsource | Sep 9, 2020 | Aug 24, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 27, 2020 | Aug 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-devel | Sep 29, 2020 | Aug 24, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-develUpgrade postgresql-testUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-testUpgrade pgauditUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-staticUpgrade postgres-decoderbufsUpgrade postgresql-contribUpgrade postgresql | Sep 10, 2020 | Aug 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.4 | Aug 17, 2020 | Aug 17, 2020 |
| Redhat_linux | — | Upgrade postgresql-contribUpgrade postgres-decoderbufs-debuginfoUpgrade pgauditUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperlUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade postgresql-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-server-debuginfo | Sep 9, 2020 | Aug 24, 2020 |
| Rocky_linux | — | Upgrade pgauditUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debugsource | Mar 12, 2024 | Aug 24, 2020 |
| Suse | — | Upgrade postgresql12-testUpgrade postgresql12-develUpgrade postgresql10-plpythonUpgrade postgresql-testUpgrade postgresql11-testUpgrade postgresql10-testUpgrade postgresql-pltclUpgrade postgresql12-llvmjitUpgrade postgresqlUpgrade postgresql96-testUpgrade postgresql-docsUpgrade postgresql11-contribUpgrade postgresql96-contribUpgrade postgresql11-serverUpgrade postgresql12Upgrade postgresql12-plperlUpgrade postgresql12-server-develUpgrade postgresql10-pltclUpgrade postgresql11-develUpgrade postgresql96-docsUpgrade postgresql96-plpythonUpgrade postgresql11-pltclUpgrade postgresql-serverUpgrade libecpg6-32bitUpgrade postgresql96-plperlUpgrade libpq5Upgrade postgresql-plperlUpgrade postgresql10-plperlUpgrade postgresql11Upgrade postgresql12-plpythonUpgrade postgresql11-llvmjitUpgrade postgresql11-plpythonUpgrade postgresql96-develUpgrade postgresql10-serverUpgrade postgresql10Upgrade postgresql12-docsUpgrade postgresql96-serverUpgrade postgresql-server-develUpgrade postgresql11-plperlUpgrade postgresql96Upgrade postgresql10-docsUpgrade postgresql-contribUpgrade postgresql12-contribUpgrade postgresql-plpythonUpgrade postgresql11-server-develUpgrade postgresql11-docsUpgrade postgresql96-pltclUpgrade libpq5-32bitUpgrade postgresql12-pltclUpgrade postgresql-llvmjitUpgrade postgresql-develUpgrade libecpg6Upgrade postgresql10-develUpgrade postgresql10-contribUpgrade postgresql12-server | Aug 18, 2020 | Aug 17, 2020 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-9.5Upgrade postgresql-12 | Aug 26, 2020 | Aug 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub