A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-serverUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade postgresql-testUpgrade pgauditUpgrade postgresqlUpgrade postgresql-staticUpgrade postgresql-plperlUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade pg_repackUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-test-rpm-macros | Jun 7, 2022 | May 30, 2022 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql13Upgrade postgresql14Upgrade postgresql12Upgrade postgresql | Aug 22, 2024 | Aug 31, 2022 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-serverUpgrade libpqUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-private-libsUpgrade postgresql-private-develUpgrade postgresql-staticUpgrade postgresqlUpgrade libpq-develUpgrade libpq-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-plpython2Upgrade postgresql-upgrade-develUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-llvmjitUpgrade postgresql-contrib | Sep 30, 2022 | Aug 31, 2022 |
| Centos_linux | — | Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plpython3Upgrade pg_repack-debugsourceUpgrade postgresql-server-develUpgrade pgauditUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-plpython3-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-docs-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresqlUpgrade postgresql-staticUpgrade postgresql-pltclUpgrade postgresql-debugsourceUpgrade postgresql-docsUpgrade pg_repackUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-server-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-testUpgrade pgaudit-debugsourceUpgrade postgresql-private-libsUpgrade postgresql-plpythonUpgrade postgresql-test-rpm-macrosUpgrade postgresql-test-debuginfo | May 31, 2022 | May 30, 2022 |
| Debian | — | Upgrade postgresql-13 | May 16, 2022 | May 16, 2022 |
| Freebsd | — | Upgrade postgresql10-serverUpgrade postgresql11-serverUpgrade postgresql14-serverUpgrade postgresql12-serverUpgrade postgresql13-server | Nov 4, 2022 | May 11, 2022 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Nov 23, 2022 | Aug 31, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-devel | Oct 28, 2022 | Aug 31, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade postgresql-docsUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-libs | Aug 18, 2022 | Aug 16, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-docsUpgrade postgresql-plpythonUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-contribUpgrade postgresql-devel | Aug 18, 2022 | Aug 16, 2022 |
| Oracle_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-develUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade postgresql-private-develUpgrade pgauditUpgrade postgresql-plpythonUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-private-libsUpgrade pg_repackUpgrade postgresql-plperlUpgrade postgresql-plpython3Upgrade postgresql-pltcl | Jun 2, 2022 | May 12, 2022 |
| Postgres | — | Upgrade to PostgreSQL version 14.3 | Aug 31, 2022 | Aug 31, 2022 |
| Redhat_linux | — | Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-staticUpgrade pgauditUpgrade postgresql-serverUpgrade postgresql-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-contrib-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-test-debuginfoUpgrade postgresql-libsUpgrade pg_repack-debugsourceUpgrade postgresql-develUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-private-libsUpgrade postgresql-contribUpgrade pg_repack-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-server-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-docs-debuginfoUpgrade postgresql-private-develUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-debuginfoUpgrade pg_repackUpgrade postgresql-upgrade-develNo solution existsUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresqlUpgrade pgaudit-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-pltcl | May 31, 2022 | May 30, 2022 |
| Rocky_linux | — | Upgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-pltcl-debuginfoUpgrade pgauditUpgrade postgresql-server-debuginfoUpgrade postgresql-docsUpgrade pg_repack-debugsourceUpgrade postgresql-private-libsUpgrade postgresql-test-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-serverUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-private-develUpgrade postgres-decoderbufsUpgrade postgresql-testUpgrade postgresql-server-devel-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgres-decoderbufs-debuginfoUpgrade pg_repackUpgrade postgresql-contribUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperlUpgrade pgaudit-debugsource | Mar 12, 2024 | Aug 31, 2022 |
| Suse | — | Upgrade postgresql-develUpgrade postgresql14-serverUpgrade postgresql14Upgrade postgresql13-llvmjitUpgrade postgresql14-plpythonUpgrade postgresql10-develUpgrade libpq5-32bitUpgrade postgresql10Upgrade postgresql14-devel-miniUpgrade postgresql-contribUpgrade postgresql14-contribUpgrade postgresql13-serverUpgrade postgresql13-testUpgrade postgresql10-serverUpgrade postgresql13-plperlUpgrade postgresql-pltclUpgrade postgresql13Upgrade postgresql13-docsUpgrade postgresql-docsUpgrade postgresql10-docsUpgrade postgresql15Upgrade postgresql12-serverUpgrade postgresql14-llvmjitUpgrade postgresql14-plperlUpgrade postgresql13-plpythonUpgrade postgresql12-contribUpgrade postgresql12-docsUpgrade postgresql12-pltclUpgrade postgresql14-develUpgrade postgresql10-plpythonUpgrade postgresql13-server-develUpgrade postgresql14-server-develUpgrade postgresql14-pltclUpgrade postgresql-serverUpgrade postgresql13-develUpgrade postgresql12-llvmjitUpgrade postgresql14-docsUpgrade postgresql12-testUpgrade postgresql13-contribUpgrade postgresqlUpgrade postgresql12-plpythonUpgrade postgresql14-llvmjit-develUpgrade libecpg6Upgrade postgresql-plpythonUpgrade postgresql10-plperlUpgrade postgresql10-llvmjit-develUpgrade postgresql10-testUpgrade postgresql12-plperlUpgrade postgresql-plperlUpgrade postgresql10-contribUpgrade postgresql14-testUpgrade postgresql-server-devel | Oct 26, 2022 | Aug 31, 2022 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-9.5 (Ubuntu Pro)Upgrade postgresql-13Upgrade postgresql-14Upgrade postgresql-12 | May 25, 2022 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub