It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Aug 24, 2020 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql14Upgrade postgresqlUpgrade postgresql12 | Sep 23, 2020 | Aug 24, 2020 |
| Amazon_linux | — | Upgrade postgresql96Upgrade postgresql95 | Oct 28, 2020 | Aug 17, 2020 |
| Centos_linux | — | Upgrade postgresql-docs-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade pgaudit-debuginfoUpgrade postgresql-plperlUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgresql-server-develUpgrade postgresql-upgrade-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-pltclUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-plpython3Upgrade postgres-decoderbufsUpgrade postgresqlUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-testUpgrade postgresql-upgradeUpgrade postgresql-test-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade postgresql-staticUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit | Sep 9, 2020 | Aug 24, 2020 |
| Debian | — | Upgrade postgresql-11 | Aug 21, 2020 | Aug 21, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 27, 2020 | Aug 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-testUpgrade postgresql-develUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-plpython | Sep 29, 2020 | Aug 24, 2020 |
| Oracle_linux | — | Upgrade postgresql-testUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-libsUpgrade postgresqlUpgrade postgres-decoderbufsUpgrade postgresql-plpython3Upgrade postgresql-upgrade-develUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade pgauditUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresqlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-docs | Sep 10, 2020 | Aug 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.4 | Aug 17, 2020 | Aug 17, 2020 |
| Redhat_linux | — | Upgrade postgresql-contrib-debuginfoUpgrade postgresql-server-develUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-serverUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-pltclUpgrade pgaudit-debuginfoNo solution existsUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-docs-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgradeUpgrade postgresql-test-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-plpython3Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade pgauditUpgrade postgresqlUpgrade postgres-decoderbufs | Sep 9, 2020 | Aug 24, 2020 |
| Rocky_linux | — | Upgrade pgaudit-debuginfoUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debuginfo | Mar 12, 2024 | Aug 24, 2020 |
| Suse | — | Upgrade postgresql12-pltclUpgrade postgresql11-develUpgrade postgresql12-plperlUpgrade postgresql96-plperlUpgrade postgresql10-develUpgrade postgresql12-plpythonUpgrade postgresql10-plpythonUpgrade postgresql11Upgrade postgresql-llvmjitUpgrade postgresql96-testUpgrade postgresql10-pltclUpgrade postgresql12-testUpgrade postgresql11-pltclUpgrade postgresql12-contribUpgrade postgresql12-server-develUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql96-pltclUpgrade postgresql11-testUpgrade postgresql96Upgrade postgresql11-plpythonUpgrade postgresql10-docsUpgrade postgresql12-develUpgrade postgresql11-docsUpgrade postgresql96-docsUpgrade postgresql10-plperlUpgrade postgresql96-serverUpgrade postgresql-develUpgrade postgresql11-plperlUpgrade postgresql11-contribUpgrade postgresql11-llvmjitUpgrade postgresql96-develUpgrade postgresql96-plpythonUpgrade postgresql96-contribUpgrade postgresql12Upgrade libpq5Upgrade postgresql11-server-develUpgrade postgresql10-serverUpgrade postgresql-plpythonUpgrade postgresql12-llvmjitUpgrade postgresqlUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql10-contribUpgrade postgresql-serverUpgrade postgresql-testUpgrade libecpg6-32bitUpgrade postgresql12-serverUpgrade postgresql12-docsUpgrade postgresql-plperlUpgrade postgresql10Upgrade postgresql10-testUpgrade libpq5-32bitUpgrade libecpg6Upgrade postgresql11-server | Aug 18, 2020 | Aug 17, 2020 |
| Ubuntu | — | Upgrade postgresql-12Upgrade postgresql-10Upgrade postgresql-9.5 | Aug 26, 2020 | Aug 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub