A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Mar 17, 2020 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresql12Upgrade postgresql | Aug 22, 2024 | Mar 17, 2020 |
| Amazon_linux | — | Upgrade postgresql96 | Oct 28, 2020 | Feb 18, 2020 |
| Centos_linux | — | Upgrade postgresql-upgrade-debuginfoUpgrade postgresql-pltclUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-plperl-debuginfoUpgrade postgresqlUpgrade postgresql-docs-debuginfoUpgrade postgresql-serverUpgrade postgresql-test-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-server-debuginfoUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgradeUpgrade pgauditUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-contribUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debuginfo | Sep 9, 2020 | Mar 17, 2020 |
| Debian | — | Upgrade postgresql-11 | Feb 18, 2020 | Feb 18, 2020 |
| Freebsd | — | Upgrade postgresql11-serverUpgrade postgresql96-serverUpgrade postgresql10-serverUpgrade postgresql12-server | Mar 30, 2020 | Mar 29, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Mar 12, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-plpython | May 27, 2020 | Mar 17, 2020 |
| Oracle_linux | — | Upgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-docsUpgrade pgauditUpgrade postgres-decoderbufsUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-docs | Sep 10, 2020 | Feb 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.2 | Feb 14, 2020 | Feb 14, 2020 |
| Redhat_linux | — | Upgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-contrib-debuginfoUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade pgauditUpgrade postgresql-plperl-debuginfoUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade pgaudit-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-testUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-pltclUpgrade postgresql-test-debuginfoUpgrade postgresqlUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debugsourceUpgrade postgresql-server | Sep 9, 2020 | Mar 17, 2020 |
| Rocky_linux | — | Upgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debugsource | Mar 12, 2024 | Mar 17, 2020 |
| Suse | — | Upgrade postgresql96-contribUpgrade postgresql96-develUpgrade postgresql12Upgrade postgresql-server-develUpgrade postgresql96-docsUpgrade postgresql-develUpgrade libecpg6Upgrade postgresql-pltclUpgrade postgresql10-docsUpgrade postgresql10-plpythonUpgrade postgresql10-develUpgrade postgresql-contribUpgrade postgresql12-testUpgrade postgresql-plperlUpgrade python3-psycopg2Upgrade postgresql12-plperlUpgrade postgresql96-pltclUpgrade postgresql10-pltclUpgrade postgresql-llvmjitUpgrade postgresql-plpythonUpgrade postgresql12-plpythonUpgrade postgresql10-contribUpgrade postgresql12-develUpgrade postgresql96-plpythonUpgrade postgresql12-server-develUpgrade postgresql10-serverUpgrade postgresql12-contribUpgrade postgresqlUpgrade postgresql96-testUpgrade postgresql10-testUpgrade postgresql96Upgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql12-llvmjitUpgrade postgresql12-docsUpgrade postgresql10Upgrade libpq5-32bitUpgrade postgresql12-serverUpgrade postgresql96-plperlUpgrade libpq5Upgrade postgresql-testUpgrade libecpg6-32bitUpgrade postgresql96-serverUpgrade postgresql10-plperlUpgrade postgresql12-pltcl | Mar 5, 2020 | Feb 18, 2020 |
| Ubuntu | — | Upgrade postgresql-11Upgrade postgresql-10 | Feb 19, 2020 | Feb 18, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub