A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-testUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade pg_repackUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-plperlUpgrade postgresql-pltcl | Jun 7, 2022 | May 30, 2022 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql12Upgrade postgresql14Upgrade postgresql13Upgrade postgresql15 | Aug 22, 2024 | Aug 31, 2022 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-plpython2Upgrade postgresql-test-rpm-macrosUpgrade postgresql-plpythonUpgrade postgresql-upgrade-develUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-llvmjitUpgrade postgresql-upgradeUpgrade postgresqlUpgrade libpq-debuginfoUpgrade postgresql-testUpgrade libpq-develUpgrade postgresql-private-libsUpgrade postgresql-libsUpgrade libpqUpgrade postgresql-serverUpgrade postgresql-staticUpgrade postgresql-plpython3Upgrade postgresql-private-develUpgrade postgresql-docs | Sep 30, 2022 | Aug 31, 2022 |
| Centos_linux | — | Upgrade postgresql-contrib-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufsUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade pgauditUpgrade pg_repack-debuginfoUpgrade pg_repack-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-serverUpgrade postgresql-docsUpgrade pg_repackUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-plpythonUpgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-debuginfoUpgrade postgresql-pltclUpgrade postgresql-debugsourceUpgrade pgaudit-debugsourceUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade postgresql-libsUpgrade postgresql-test-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-plperl-debuginfo | May 31, 2022 | May 30, 2022 |
| Debian | — | Upgrade postgresql-13 | May 16, 2022 | May 16, 2022 |
| Freebsd | — | Upgrade postgresql14-serverUpgrade postgresql13-serverUpgrade postgresql11-serverUpgrade postgresql12-serverUpgrade postgresql10-server | Nov 4, 2022 | May 11, 2022 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Nov 23, 2022 | Aug 31, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-libs | Oct 28, 2022 | Aug 31, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade postgresql-plpythonUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-develUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-docs | Aug 18, 2022 | Aug 16, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql-docsUpgrade postgresql-test | Aug 18, 2022 | Aug 16, 2022 |
| Oracle_linux | — | Upgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-libsUpgrade pg_repackUpgrade postgresql-private-libsUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-upgrade-develUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpythonUpgrade pgauditUpgrade postgresql-private-develUpgrade postgres-decoderbufsUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-upgrade | Jun 2, 2022 | May 12, 2022 |
| Postgres | — | Upgrade to PostgreSQL version 14.3 | Aug 31, 2022 | Aug 31, 2022 |
| Redhat_linux | — | Upgrade postgresql-upgrade-develNo solution existsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-private-libsUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-pltclUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-private-develUpgrade postgresql-docs-debuginfoUpgrade postgresql-contribUpgrade pg_repack-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade pg_repackUpgrade postgresql-debuginfoUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-staticUpgrade postgres-decoderbufs-debugsourceUpgrade postgres-decoderbufsUpgrade postgresql-pltcl-debuginfoUpgrade pgauditUpgrade postgresql-contrib-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-develUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-plperl-debuginfoUpgrade postgresql-plpython3-debuginfo | May 31, 2022 | May 30, 2022 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade pg_repackUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-docs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-contribUpgrade postgresql-private-libs-debuginfoUpgrade pg_repack-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql-upgrade-develUpgrade postgresql-private-develUpgrade postgres-decoderbufsUpgrade pg_repack-debugsourceUpgrade postgresql-serverUpgrade postgresql-private-libsUpgrade pgaudit-debuginfoUpgrade postgresql-docsUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-testUpgrade postgresql-upgradeUpgrade postgresql-staticUpgrade postgresqlUpgrade pgauditUpgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-pltcl-debuginfo | Mar 12, 2024 | Aug 31, 2022 |
| Suse | — | Upgrade postgresql14-docsUpgrade postgresql10-testUpgrade postgresql13-develUpgrade postgresqlUpgrade postgresql12-server-develUpgrade postgresql14-pltclUpgrade postgresql12-develUpgrade libecpg6Upgrade postgresql13-pltclUpgrade postgresql12-plperlUpgrade postgresql12-llvmjit-develUpgrade postgresql14-llvmjit-develUpgrade postgresql10-plpythonUpgrade postgresql12-plpythonUpgrade libecpg6-32bitUpgrade postgresql-plperlUpgrade libpq5Upgrade postgresql10-llvmjit-develUpgrade postgresql14-server-develUpgrade postgresql-plpythonUpgrade postgresql12Upgrade postgresql10-contribUpgrade postgresql13-contribUpgrade postgresql13-llvmjit-develUpgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql12-llvmjitUpgrade postgresql14-testUpgrade postgresql13-server-develUpgrade postgresql10-plperlUpgrade postgresql14-serverUpgrade postgresql12-testUpgrade postgresql10-pltclUpgrade postgresql13-plperlUpgrade postgresql14-plpythonUpgrade libpq5-32bitUpgrade postgresql14-llvmjitUpgrade postgresql-docsUpgrade postgresql10-docsUpgrade postgresql14Upgrade postgresql13-llvmjitUpgrade postgresql10-develUpgrade postgresql12-contribUpgrade postgresql12-serverUpgrade postgresql14-develUpgrade postgresql14-devel-miniUpgrade postgresql13-serverUpgrade postgresql10Upgrade postgresql14-contribUpgrade postgresql-contribUpgrade postgresql13Upgrade postgresql12-pltclUpgrade postgresql12-docsUpgrade postgresql13-docsUpgrade postgresql13-testUpgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql10-serverUpgrade postgresql14-plperlUpgrade postgresql13-plpythonUpgrade postgresql15 | Oct 26, 2022 | Aug 31, 2022 |
| Ubuntu | — | Upgrade postgresql-12Upgrade postgresql-14Upgrade postgresql-13Upgrade postgresql-9.5 (Ubuntu Pro)Upgrade postgresql-10 | May 25, 2022 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub