It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Aug 24, 2020 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql14Upgrade postgresql12Upgrade postgresql15 | Sep 23, 2020 | Aug 24, 2020 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql96 | Oct 28, 2020 | Aug 17, 2020 |
| Centos_linux | — | Upgrade postgresql-contribUpgrade postgresql-serverUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-pltclUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-server-develUpgrade pgaudit-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-plpython3Upgrade postgresql-debugsourceUpgrade postgresql-server-debuginfoUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-test-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade pgauditUpgrade postgresql-static | Sep 9, 2020 | Aug 24, 2020 |
| Debian | — | Upgrade postgresql-11 | Aug 21, 2020 | Aug 21, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 27, 2020 | Aug 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql | Sep 29, 2020 | Aug 24, 2020 |
| Oracle_linux | — | Upgrade postgresql-contribUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade pgauditUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-libsUpgrade postgresqlUpgrade postgresql-upgrade-develUpgrade postgresql-testUpgrade postgresql-upgradeUpgrade postgres-decoderbufs | Sep 10, 2020 | Aug 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.4 | Aug 17, 2020 | Aug 17, 2020 |
| Redhat_linux | — | Upgrade postgresql-plperl-debuginfoUpgrade postgresql-docsUpgrade postgresql-debuginfoUpgrade postgresql-staticUpgrade pgauditUpgrade postgresqlUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-testUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-docs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgradeUpgrade pgaudit-debuginfoNo solution existsUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-debugsourceUpgrade postgresql-server-devel | Sep 9, 2020 | Aug 24, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufsUpgrade pgauditUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debugsourceUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debugsource | Mar 12, 2024 | Aug 24, 2020 |
| Suse | — | Upgrade postgresql96-pltclUpgrade postgresql10-develUpgrade postgresql96-contribUpgrade postgresql11-plperlUpgrade postgresql96-serverUpgrade postgresql96-docsUpgrade postgresql10-plperlUpgrade postgresql12-testUpgrade postgresql96Upgrade postgresql12-plpythonUpgrade postgresql12-plperlUpgrade postgresql-develUpgrade postgresql96-plperlUpgrade postgresql-llvmjitUpgrade postgresql11Upgrade postgresql-docsUpgrade postgresql11-pltclUpgrade postgresql10-docsUpgrade postgresql12-server-develUpgrade postgresql12-contribUpgrade postgresql11-plpythonUpgrade postgresql12-pltclUpgrade postgresql11-contribUpgrade postgresql-contribUpgrade postgresql96-testUpgrade postgresql11-testUpgrade postgresql10-pltclUpgrade postgresql12-develUpgrade postgresql11-docsUpgrade postgresql11-llvmjitUpgrade postgresql96-plpythonUpgrade postgresql11-develUpgrade postgresql10-plpythonUpgrade postgresql96-develUpgrade postgresql-serverUpgrade postgresql11-server-develUpgrade postgresql-plperlUpgrade libecpg6-32bitUpgrade postgresql10Upgrade postgresql-server-develUpgrade postgresql10-testUpgrade libpq5-32bitUpgrade postgresql-testUpgrade postgresql12-llvmjitUpgrade postgresql-plpythonUpgrade postgresqlUpgrade postgresql11-serverUpgrade postgresql12Upgrade postgresql10-contribUpgrade postgresql12-docsUpgrade postgresql12-serverUpgrade libecpg6Upgrade postgresql-pltclUpgrade postgresql10-serverUpgrade libpq5 | Aug 18, 2020 | Aug 17, 2020 |
| Ubuntu | — | Upgrade postgresql-12Upgrade postgresql-9.5Upgrade postgresql-10 | Aug 26, 2020 | Aug 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub