A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Mar 17, 2020 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql15Upgrade postgresql12Upgrade postgresql14 | Aug 22, 2024 | Mar 17, 2020 |
| Amazon_linux | — | Upgrade postgresql96 | Oct 28, 2020 | Feb 18, 2020 |
| Centos_linux | — | Upgrade postgresql-test-debuginfoUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade pgaudit-debugsourceUpgrade postgresql-pltclUpgrade postgresql-server-debuginfoUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-docs-debuginfoUpgrade postgresql-docsUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-staticUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-develUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-debugsourceUpgrade postgres-decoderbufsUpgrade postgresql-contribUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-develUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-plpython3-debuginfo | Sep 9, 2020 | Mar 17, 2020 |
| Debian | — | Upgrade postgresql-11 | Feb 18, 2020 | Feb 18, 2020 |
| Freebsd | — | Upgrade postgresql12-serverUpgrade postgresql96-serverUpgrade postgresql10-serverUpgrade postgresql11-server | Mar 30, 2020 | Mar 29, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Mar 12, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-contrib | May 27, 2020 | Mar 17, 2020 |
| Oracle_linux | — | Upgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-testUpgrade pgauditUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-staticUpgrade postgres-decoderbufsUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-docsUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-testUpgrade postgresql | Sep 10, 2020 | Feb 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.2 | Feb 14, 2020 | Feb 14, 2020 |
| Redhat_linux | — | Upgrade postgres-decoderbufs-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-debuginfoUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql-plpython3Upgrade pgaudit-debugsourceUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-testUpgrade postgresql-pltcl | Sep 9, 2020 | Mar 17, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufsUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade pgaudit-debuginfo | Mar 12, 2024 | Mar 17, 2020 |
| Suse | — | Upgrade postgresql-llvmjitUpgrade postgresql12-plperlUpgrade postgresql96-plpythonUpgrade libecpg6Upgrade postgresql-plpythonUpgrade python3-psycopg2Upgrade postgresql10-contribUpgrade postgresql12-develUpgrade postgresql96-pltclUpgrade postgresql12-testUpgrade postgresql96-develUpgrade postgresql10-docsUpgrade postgresql-pltclUpgrade postgresql96-contribUpgrade postgresql12Upgrade postgresql12-plpythonUpgrade postgresql-server-develUpgrade postgresql96-docsUpgrade postgresql-plperlUpgrade postgresql10-develUpgrade postgresql10-plpythonUpgrade postgresql-develUpgrade postgresql10-pltclUpgrade postgresql-contribUpgrade postgresql12-serverUpgrade postgresql96Upgrade postgresql10-plperlUpgrade libecpg6-32bitUpgrade postgresql10Upgrade postgresql96-testUpgrade postgresqlUpgrade postgresql10-serverUpgrade libpq5Upgrade postgresql96-plperlUpgrade postgresql12-docsUpgrade postgresql12-llvmjitUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql12-server-develUpgrade postgresql10-testUpgrade postgresql96-serverUpgrade postgresql12-pltclUpgrade postgresql-docsUpgrade postgresql12-contribUpgrade libpq5-32bit | Mar 5, 2020 | Feb 18, 2020 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-11 | Feb 19, 2020 | Feb 18, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub