It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Aug 24, 2020 |
| Alpine Linux | — | Upgrade postgresql12Upgrade postgresqlUpgrade postgresql14Upgrade postgresql15 | Sep 23, 2020 | Aug 24, 2020 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql96 | Oct 28, 2020 | Aug 17, 2020 |
| Centos_linux | — | Upgrade postgresql-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-test-debuginfoUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-server-debuginfoUpgrade postgresql-staticUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-testUpgrade postgresql-plpython3Upgrade pgauditUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-serverUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docs-debuginfoUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-contribUpgrade postgresql-plperl-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperlUpgrade postgresql-pltcl | Sep 9, 2020 | Aug 24, 2020 |
| Debian | — | Upgrade postgresql-11 | Aug 21, 2020 | Aug 21, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 27, 2020 | Aug 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-testUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-docs | Sep 29, 2020 | Aug 24, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-staticUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-server-develUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-develUpgrade postgresql-testUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-libsUpgrade postgresqlUpgrade rh-postgresql10-postgresql-server | Sep 10, 2020 | Aug 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.4 | Aug 17, 2020 | Aug 17, 2020 |
| Redhat_linux | — | Upgrade postgresql-upgrade-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contribNo solution existsUpgrade postgresql-upgrade-develUpgrade postgresql-debugsourceUpgrade postgresql-serverUpgrade postgresql-contrib-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-testUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-debuginfoUpgrade pgauditUpgrade postgresqlUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-docsUpgrade postgresql-plperl-debuginfoUpgrade postgresql-static | Sep 9, 2020 | Aug 24, 2020 |
| Rocky_linux | — | Upgrade pgauditUpgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debugsourceUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debugsource | Mar 12, 2024 | Aug 24, 2020 |
| Suse | — | Upgrade libpq5Upgrade postgresql10-serverUpgrade postgresql11-server-develUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql12Upgrade postgresql10-testUpgrade postgresql12-docsUpgrade postgresql12-serverUpgrade postgresql11-serverUpgrade postgresqlUpgrade postgresql12-llvmjitUpgrade postgresql-plperlUpgrade libecpg6Upgrade postgresql-plpythonUpgrade libpq5-32bitUpgrade libecpg6-32bitUpgrade postgresql10Upgrade postgresql10-contribUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql11Upgrade postgresql10-develUpgrade postgresql-develUpgrade postgresql10-plperlUpgrade postgresql11-develUpgrade postgresql-contribUpgrade postgresql12-plperlUpgrade postgresql-llvmjitUpgrade postgresql12-plpythonUpgrade postgresql10-plpythonUpgrade postgresql96-serverUpgrade postgresql96-contribUpgrade postgresql11-testUpgrade postgresql10-docsUpgrade postgresql12-testUpgrade postgresql96Upgrade postgresql12-server-develUpgrade postgresql12-develUpgrade postgresql96-pltclUpgrade postgresql11-docsUpgrade postgresql11-plpythonUpgrade postgresql-docsUpgrade postgresql96-plperlUpgrade postgresql12-contribUpgrade postgresql11-contribUpgrade postgresql96-docsUpgrade postgresql96-develUpgrade postgresql96-testUpgrade postgresql11-plperlUpgrade postgresql96-plpythonUpgrade postgresql11-pltclUpgrade postgresql11-llvmjitUpgrade postgresql10-pltclUpgrade postgresql12-pltcl | Aug 18, 2020 | Aug 17, 2020 |
| Ubuntu | — | Upgrade postgresql-12Upgrade postgresql-10Upgrade postgresql-9.5 | Aug 26, 2020 | Aug 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub