A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Mar 17, 2020 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresqlUpgrade postgresql12Upgrade postgresql14 | Aug 22, 2024 | Mar 17, 2020 |
| Amazon_linux | — | Upgrade postgresql96 | Oct 28, 2020 | Feb 18, 2020 |
| Centos_linux | — | Upgrade postgresql-serverUpgrade postgresql-server-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-testUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade pgaudit-debugsourceUpgrade postgresql-plperlUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade pgauditUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-contribUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufs | Sep 9, 2020 | Mar 17, 2020 |
| Debian | — | Upgrade postgresql-11 | Feb 18, 2020 | Feb 18, 2020 |
| Freebsd | — | Upgrade postgresql11-serverUpgrade postgresql10-serverUpgrade postgresql96-serverUpgrade postgresql12-server | Mar 30, 2020 | Mar 29, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Mar 12, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-plpython | May 27, 2020 | Mar 17, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-syspathsUpgrade pgauditUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-staticUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-docsUpgrade postgres-decoderbufsUpgrade rh-postgresql10-postgresql-testUpgrade postgresqlUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresqlUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-pltclUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-server | Sep 10, 2020 | Feb 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.2 | Feb 14, 2020 | Feb 14, 2020 |
| Redhat_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade pgaudit-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-pltclUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-testUpgrade postgresql-test-debuginfoUpgrade postgresql-staticUpgrade pgauditUpgrade postgresql-plperl-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-upgradeUpgrade pgaudit-debuginfoUpgrade postgresql-contribUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-docsUpgrade postgresql-contrib-debuginfo | Sep 9, 2020 | Mar 17, 2020 |
| Rocky_linux | — | Upgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pgauditUpgrade postgres-decoderbufs-debugsourceUpgrade postgres-decoderbufsUpgrade pgaudit-debugsource | Mar 12, 2024 | Mar 17, 2020 |
| Suse | — | Upgrade postgresql96-contribUpgrade postgresql-plpythonUpgrade libecpg6Upgrade python3-psycopg2Upgrade postgresql12-develUpgrade postgresql10-contribUpgrade postgresql-contribUpgrade postgresql12-plperlUpgrade postgresql96-develUpgrade postgresql-llvmjitUpgrade postgresql10-pltclUpgrade postgresql96-docsUpgrade postgresql-pltclUpgrade postgresql12-testUpgrade postgresql-server-develUpgrade postgresql96-plpythonUpgrade postgresql10-develUpgrade postgresql10-docsUpgrade postgresql96-pltclUpgrade postgresql12Upgrade postgresql12-plpythonUpgrade postgresql-plperlUpgrade postgresql10-plpythonUpgrade postgresql-develUpgrade postgresql12-docsUpgrade postgresql10-serverUpgrade postgresql-serverUpgrade postgresql96Upgrade postgresql12-llvmjitUpgrade postgresql12-contribUpgrade postgresql10-plperlUpgrade postgresqlUpgrade libecpg6-32bitUpgrade postgresql-docsUpgrade postgresql12-pltclUpgrade postgresql96-serverUpgrade postgresql10Upgrade postgresql12-serverUpgrade postgresql-testUpgrade postgresql96-plperlUpgrade libpq5Upgrade postgresql10-testUpgrade postgresql96-testUpgrade libpq5-32bitUpgrade postgresql12-server-devel | Mar 5, 2020 | Feb 18, 2020 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-11 | Feb 19, 2020 | Feb 18, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub