It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Aug 24, 2020 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresqlUpgrade postgresql12Upgrade postgresql15 | Sep 23, 2020 | Aug 24, 2020 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql96 | Oct 28, 2020 | Aug 17, 2020 |
| Centos_linux | — | Upgrade postgresql-server-devel-debuginfoUpgrade pgauditUpgrade postgresql-plpython3Upgrade postgresql-test-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-upgradeUpgrade postgres-decoderbufs-debuginfoUpgrade postgresqlUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltclUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-serverUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-plperlUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-devel | Sep 9, 2020 | Aug 24, 2020 |
| Debian | — | Upgrade postgresql-11 | Aug 21, 2020 | Aug 21, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 27, 2020 | Aug 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-libsUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-develUpgrade postgresql-docs | Sep 29, 2020 | Aug 24, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufsUpgrade pgauditUpgrade rh-postgresql10-postgresql-serverUpgrade postgresqlUpgrade postgresql-server-develUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-libsUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-server-syspaths | Sep 10, 2020 | Aug 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.4 | Aug 17, 2020 | Aug 17, 2020 |
| Redhat_linux | — | Upgrade pgaudit-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-server-develUpgrade postgresql-docs-debuginfoUpgrade postgresql-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plperlUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-serverUpgrade postgresql-upgrade-develNo solution existsUpgrade pgauditUpgrade postgres-decoderbufsUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-plperl-debuginfoUpgrade postgresql-testUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufs-debuginfo | Sep 9, 2020 | Aug 24, 2020 |
| Rocky_linux | — | Upgrade pgaudit-debuginfoUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debuginfo | Mar 12, 2024 | Aug 24, 2020 |
| Suse | — | Upgrade postgresql10Upgrade libecpg6-32bitUpgrade postgresql-serverUpgrade libpq5-32bitUpgrade libecpg6Upgrade postgresql-testUpgrade postgresql-pltclUpgrade libpq5Upgrade postgresql-server-develUpgrade postgresql10-serverUpgrade postgresql-plperlUpgrade postgresql11-server-develUpgrade postgresql11-serverUpgrade postgresql-plpythonUpgrade postgresql12-llvmjitUpgrade postgresqlUpgrade postgresql12-serverUpgrade postgresql12-docsUpgrade postgresql10-contribUpgrade postgresql10-testUpgrade postgresql12Upgrade postgresql11-pltclUpgrade postgresql11-plperlUpgrade postgresql96-serverUpgrade postgresql96-docsUpgrade postgresql10-pltclUpgrade postgresql11-plpythonUpgrade postgresql11Upgrade postgresql-docsUpgrade postgresql11-contribUpgrade postgresql96-develUpgrade postgresql-develUpgrade postgresql11-testUpgrade postgresql96Upgrade postgresql10-docsUpgrade postgresql11-docsUpgrade postgresql12-contribUpgrade postgresql12-server-develUpgrade postgresql96-pltclUpgrade postgresql-contribUpgrade postgresql10-plperlUpgrade postgresql10-develUpgrade postgresql12-pltclUpgrade postgresql10-plpythonUpgrade postgresql11-develUpgrade postgresql12-plpythonUpgrade postgresql12-develUpgrade postgresql96-plpythonUpgrade postgresql12-testUpgrade postgresql96-plperlUpgrade postgresql96-contribUpgrade postgresql-llvmjitUpgrade postgresql12-plperlUpgrade postgresql11-llvmjitUpgrade postgresql96-test | Aug 18, 2020 | Aug 17, 2020 |
| Ubuntu | — | Upgrade postgresql-12Upgrade postgresql-10Upgrade postgresql-9.5 | Aug 26, 2020 | Aug 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub