A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Mar 17, 2020 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresql12Upgrade postgresql | Aug 22, 2024 | Mar 17, 2020 |
| Amazon_linux | — | Upgrade postgresql96 | Oct 28, 2020 | Feb 18, 2020 |
| Centos_linux | — | Upgrade postgresql-test-debuginfoUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-server-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-serverUpgrade postgresqlUpgrade postgres-decoderbufsUpgrade postgresql-contribUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-upgrade-develUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-develUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-debugsource | Sep 9, 2020 | Mar 17, 2020 |
| Debian | — | Upgrade postgresql-11 | Feb 18, 2020 | Feb 18, 2020 |
| Freebsd | — | Upgrade postgresql11-serverUpgrade postgresql10-serverUpgrade postgresql96-serverUpgrade postgresql12-server | Mar 30, 2020 | Mar 29, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Mar 12, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-test | May 27, 2020 | Mar 17, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresqlUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresqlUpgrade postgres-decoderbufsUpgrade postgresql-plperlUpgrade pgauditUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-contrib-syspaths | Sep 10, 2020 | Feb 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.2 | Feb 14, 2020 | Feb 14, 2020 |
| Redhat_linux | — | Upgrade postgresql-upgrade-develUpgrade postgresql-plperl-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade pgauditUpgrade postgres-decoderbufsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-docsUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-upgrade-debuginfoUpgrade postgresqlUpgrade postgresql-debugsourceUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade pgaudit-debugsourceUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-develUpgrade postgresql-docs-debuginfo | Sep 9, 2020 | Mar 17, 2020 |
| Rocky_linux | — | Upgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufsUpgrade pgaudit | Mar 12, 2024 | Mar 17, 2020 |
| Suse | — | Upgrade python3-psycopg2Upgrade postgresql-plpythonUpgrade postgresql10-develUpgrade postgresql12-develUpgrade postgresql96-pltclUpgrade postgresql10-contribUpgrade postgresql10-pltclUpgrade postgresql96-plpythonUpgrade libecpg6Upgrade postgresql-llvmjitUpgrade postgresql-develUpgrade postgresql12-plpythonUpgrade postgresql12Upgrade postgresql96-develUpgrade postgresql12-testUpgrade postgresql10-plpythonUpgrade postgresql96-docsUpgrade postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgresql12-plperlUpgrade postgresql-pltclUpgrade postgresql10-docsUpgrade postgresql96-contribUpgrade postgresql-serverUpgrade postgresql10-testUpgrade postgresql96-plperlUpgrade libpq5Upgrade postgresql96-testUpgrade postgresql12-serverUpgrade postgresql10Upgrade postgresql12-llvmjitUpgrade libpq5-32bitUpgrade libecpg6-32bitUpgrade postgresql96-serverUpgrade postgresql12-contribUpgrade postgresql10-plperlUpgrade postgresql12-pltclUpgrade postgresql10-serverUpgrade postgresql12-server-develUpgrade postgresql96Upgrade postgresql12-docsUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-test | Mar 5, 2020 | Feb 18, 2020 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-11 | Feb 19, 2020 | Feb 18, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub