It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Aug 24, 2020 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql14Upgrade postgresql12Upgrade postgresql | Sep 23, 2020 | Aug 24, 2020 |
| Amazon_linux | — | Upgrade postgresql96Upgrade postgresql95 | Oct 28, 2020 | Aug 17, 2020 |
| Centos_linux | — | Upgrade postgresql-testUpgrade postgresql-upgrade-develUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-debuginfoUpgrade pgauditUpgrade postgresql-plpython3Upgrade postgresql-plperl-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade pgaudit-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade postgresql-plpython3-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-devel | Sep 9, 2020 | Aug 24, 2020 |
| Debian | — | Upgrade postgresql-11 | Aug 21, 2020 | Aug 21, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 27, 2020 | Aug 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-testUpgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql | Sep 29, 2020 | Aug 24, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-docsUpgrade rh-postgresql10-postgresqlUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade pgauditUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-upgrade-develUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-serverUpgrade postgres-decoderbufsUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql | Sep 10, 2020 | Aug 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.4 | Aug 17, 2020 | Aug 17, 2020 |
| Redhat_linux | — | Upgrade postgresql-test-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-upgrade-debuginfoNo solution existsUpgrade pgaudit-debugsourceUpgrade postgresql-contribUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-serverUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-develUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plperlUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-docsUpgrade postgresql-server-debuginfoUpgrade postgresql-testUpgrade postgresqlUpgrade pgauditUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-static | Sep 9, 2020 | Aug 24, 2020 |
| Rocky_linux | — | Upgrade pgauditUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufsUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debugsource | Mar 12, 2024 | Aug 24, 2020 |
| Suse | — | Upgrade postgresqlUpgrade postgresql12-docsUpgrade postgresql12-serverUpgrade libpq5-32bitUpgrade postgresql10-testUpgrade postgresql-plperlUpgrade libecpg6Upgrade libecpg6-32bitUpgrade postgresql-plpythonUpgrade postgresql11-server-develUpgrade postgresql12Upgrade libpq5Upgrade postgresql10-contribUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql10Upgrade postgresql11-serverUpgrade postgresql-testUpgrade postgresql10-serverUpgrade postgresql12-llvmjitUpgrade postgresql-server-develUpgrade postgresql12-plperlUpgrade postgresql10-plpythonUpgrade postgresql12-contribUpgrade postgresql12-pltclUpgrade postgresql11-docsUpgrade postgresql96Upgrade postgresql12-develUpgrade postgresql10-develUpgrade postgresql12-testUpgrade postgresql96-contribUpgrade postgresql-contribUpgrade postgresql96-plperlUpgrade postgresql10-plperlUpgrade postgresql96-serverUpgrade postgresql96-docsUpgrade postgresql10-pltclUpgrade postgresql11-plperlUpgrade postgresql-llvmjitUpgrade postgresql96-pltclUpgrade postgresql12-server-develUpgrade postgresql11-contribUpgrade postgresql-docsUpgrade postgresql11-pltclUpgrade postgresql96-testUpgrade postgresql-develUpgrade postgresql96-develUpgrade postgresql11-llvmjitUpgrade postgresql96-plpythonUpgrade postgresql11Upgrade postgresql12-plpythonUpgrade postgresql10-docsUpgrade postgresql11-develUpgrade postgresql11-testUpgrade postgresql11-plpython | Aug 18, 2020 | Aug 17, 2020 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-10Upgrade postgresql-12 | Aug 26, 2020 | Aug 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub