A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Mar 17, 2020 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql12Upgrade postgresqlUpgrade postgresql14 | Aug 22, 2024 | Mar 17, 2020 |
| Amazon_linux | — | Upgrade postgresql96 | Oct 28, 2020 | Feb 18, 2020 |
| Centos_linux | — | Upgrade postgresql-plperl-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-pltclUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade postgresql-debugsourceUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-develUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plpython3Upgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade postgresql-server-devel-debuginfo | Sep 9, 2020 | Mar 17, 2020 |
| Debian | — | Upgrade postgresql-11 | Feb 18, 2020 | Feb 18, 2020 |
| Freebsd | — | Upgrade postgresql96-serverUpgrade postgresql10-serverUpgrade postgresql11-serverUpgrade postgresql12-server | Mar 30, 2020 | Mar 29, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Mar 12, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-pltcl | May 27, 2020 | Mar 17, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-libsUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresqlUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-testUpgrade postgresqlUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql-plperlUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-docsUpgrade pgauditUpgrade postgresql-serverUpgrade postgresql-test | Sep 10, 2020 | Feb 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.2 | Feb 14, 2020 | Feb 14, 2020 |
| Redhat_linux | — | Upgrade postgresql-server-develUpgrade postgresql-debugsourceUpgrade postgresqlUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-upgrade-debuginfoUpgrade postgresql-testUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debugsourceUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-staticUpgrade postgresql-contrib-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-develUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pgauditUpgrade postgresql-upgradeUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs | Sep 9, 2020 | Mar 17, 2020 |
| Rocky_linux | — | Upgrade pgauditUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufsUpgrade pgaudit-debuginfo | Mar 12, 2024 | Mar 17, 2020 |
| Suse | — | Upgrade postgresql96-serverUpgrade postgresql12-llvmjitUpgrade postgresql-serverUpgrade postgresql12-docsUpgrade postgresqlUpgrade postgresql96-plperlUpgrade libpq5-32bitUpgrade postgresql96Upgrade postgresql96-testUpgrade postgresql10-serverUpgrade postgresql-testUpgrade libpq5Upgrade postgresql12-server-develUpgrade postgresql-docsUpgrade postgresql12-contribUpgrade postgresql12-pltclUpgrade postgresql10-plperlUpgrade postgresql10-testUpgrade libecpg6-32bitUpgrade postgresql10Upgrade postgresql12-serverUpgrade postgresql-plpythonUpgrade libecpg6Upgrade python3-psycopg2Upgrade postgresql12-testUpgrade postgresql96-plpythonUpgrade postgresql-plperlUpgrade postgresql10-pltclUpgrade postgresql10-docsUpgrade postgresql12Upgrade postgresql96-pltclUpgrade postgresql10-contribUpgrade postgresql-pltclUpgrade postgresql12-plperlUpgrade postgresql-contribUpgrade postgresql96-docsUpgrade postgresql-develUpgrade postgresql10-plpythonUpgrade postgresql-server-develUpgrade postgresql12-plpythonUpgrade postgresql10-develUpgrade postgresql96-contribUpgrade postgresql12-develUpgrade postgresql96-develUpgrade postgresql-llvmjit | Mar 5, 2020 | Feb 18, 2020 |
| Ubuntu | — | Upgrade postgresql-11Upgrade postgresql-10 | Feb 19, 2020 | Feb 18, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub