A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Mar 17, 2020 |
| Alpine Linux | — | Upgrade postgresql12Upgrade postgresqlUpgrade postgresql15Upgrade postgresql14 | Aug 22, 2024 | Mar 17, 2020 |
| Amazon_linux | — | Upgrade postgresql96 | Oct 28, 2020 | Feb 18, 2020 |
| Centos_linux | — | Upgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql-debuginfoUpgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-plperl-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresqlUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-serverUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contribUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-develUpgrade pgaudit | Sep 9, 2020 | Mar 17, 2020 |
| Debian | — | Upgrade postgresql-11 | Feb 18, 2020 | Feb 18, 2020 |
| Freebsd | — | Upgrade postgresql11-serverUpgrade postgresql10-serverUpgrade postgresql96-serverUpgrade postgresql12-server | Mar 30, 2020 | Mar 29, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Mar 12, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql | May 27, 2020 | Mar 17, 2020 |
| Oracle_linux | — | Upgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-serverUpgrade pgauditUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgres-decoderbufsUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-testUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgresql | Sep 10, 2020 | Feb 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.2 | Feb 14, 2020 | Feb 14, 2020 |
| Redhat_linux | — | Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-pltcl-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-debuginfoUpgrade pgauditUpgrade postgres-decoderbufsUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-plperl-debuginfoUpgrade postgresql-staticUpgrade postgresql-server-develUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-serverUpgrade postgresql-server-debuginfoUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresqlUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3Upgrade pgaudit-debugsourceUpgrade postgresql-plperl | Sep 9, 2020 | Mar 17, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufsUpgrade pgaudit-debugsourceUpgrade pgaudit-debuginfo | Mar 12, 2024 | Mar 17, 2020 |
| Suse | — | Upgrade postgresql10-plperlUpgrade postgresql12-contribUpgrade postgresql96-serverUpgrade postgresqlUpgrade postgresql12-pltclUpgrade libecpg6-32bitUpgrade libpq5-32bitUpgrade postgresql-docsUpgrade libpq5Upgrade postgresql96-plperlUpgrade postgresql-testUpgrade postgresql12-server-develUpgrade postgresql10Upgrade postgresql96Upgrade postgresql12-serverUpgrade postgresql12-docsUpgrade postgresql12-llvmjitUpgrade postgresql10-testUpgrade postgresql-serverUpgrade postgresql10-serverUpgrade postgresql96-testUpgrade postgresql10-pltclUpgrade python3-psycopg2Upgrade postgresql12-plpythonUpgrade postgresql-plperlUpgrade postgresql10-develUpgrade postgresql-plpythonUpgrade postgresql10-plpythonUpgrade postgresql96-plpythonUpgrade libecpg6Upgrade postgresql-develUpgrade postgresql-server-develUpgrade postgresql12-testUpgrade postgresql96-docsUpgrade postgresql-llvmjitUpgrade postgresql10-contribUpgrade postgresql12-develUpgrade postgresql96-pltclUpgrade postgresql96-develUpgrade postgresql96-contribUpgrade postgresql12Upgrade postgresql10-docsUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql12-plperl | Mar 5, 2020 | Feb 18, 2020 |
| Ubuntu | — | Upgrade postgresql-11Upgrade postgresql-10 | Feb 19, 2020 | Feb 18, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub