It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Aug 24, 2020 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql12Upgrade postgresql15Upgrade postgresql14 | Sep 23, 2020 | Aug 24, 2020 |
| Centos_linux | — | Upgrade postgresql-upgradeUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debugsourceUpgrade postgres-decoderbufsUpgrade postgresql-test-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contribUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade pgaudit-debugsourceUpgrade pgauditUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-staticUpgrade postgresql-debuginfoUpgrade postgresql-docsUpgrade postgresql-test-rpm-macros | Sep 9, 2020 | Aug 24, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 27, 2020 | Aug 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-testUpgrade postgresql-plpythonUpgrade postgresql-libsUpgrade postgresql-plperl | Sep 29, 2020 | Aug 24, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-libsUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgres-decoderbufsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresqlUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-testUpgrade pgaudit | Sep 10, 2020 | Aug 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.4 | Aug 17, 2020 | Aug 17, 2020 |
| Redhat_linux | — | Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-docsUpgrade pgauditUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-staticUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-serverUpgrade postgres-decoderbufsUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-testUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macrosUpgrade postgresqlUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plpython3Upgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-debugsourceUpgrade postgresql-server-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-upgradeUpgrade pgaudit-debuginfo | Sep 9, 2020 | Aug 24, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debugsourceUpgrade pgauditUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfo | Mar 12, 2024 | Aug 24, 2020 |
| Suse | — | Upgrade libpq5Upgrade postgresql10-plpythonUpgrade postgresql12-plpythonUpgrade libecpg6-32bitUpgrade postgresql11Upgrade postgresql96-contribUpgrade postgresql11-contribUpgrade postgresql-docsUpgrade postgresql11-testUpgrade postgresql96-develUpgrade postgresql12-develUpgrade postgresql11-llvmjitUpgrade postgresql96-testUpgrade postgresql12-testUpgrade postgresql-serverUpgrade postgresql10-plperlUpgrade postgresql96-plpythonUpgrade postgresql12-plperlUpgrade postgresql12Upgrade postgresql96-plperlUpgrade postgresql-plperlUpgrade postgresql96-docsUpgrade postgresql12-llvmjitUpgrade postgresql10-testUpgrade postgresql11-plpythonUpgrade postgresql11-develUpgrade postgresql11-serverUpgrade postgresql10-pltclUpgrade postgresql12-server-develUpgrade postgresql-testUpgrade postgresql11-pltclUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql96-pltclUpgrade postgresql12-contribUpgrade libpq5-32bitUpgrade postgresql96Upgrade postgresql11-plperlUpgrade postgresql12-serverUpgrade postgresql-contribUpgrade postgresql96-serverUpgrade postgresql10-contribUpgrade postgresql12-docsUpgrade postgresql10Upgrade postgresql12-pltclUpgrade postgresql-llvmjitUpgrade postgresql-server-develUpgrade postgresql10-develUpgrade libecpg6Upgrade postgresql11-docsUpgrade postgresql10-serverUpgrade postgresql-plpythonUpgrade postgresql10-docsUpgrade postgresql11-server-develUpgrade postgresql-devel | Aug 18, 2020 | Aug 17, 2020 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-10Upgrade postgresql-12 | Aug 26, 2020 | Aug 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub