A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-upgrade-develUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpython3Upgrade pg_repackUpgrade postgres-decoderbufsUpgrade postgresql-testUpgrade postgresql-serverUpgrade pgauditUpgrade postgresqlUpgrade postgresql-staticUpgrade postgresql-docs | Jun 7, 2022 | May 30, 2022 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql12Upgrade postgresqlUpgrade postgresql15Upgrade postgresql13 | Aug 22, 2024 | Aug 31, 2022 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-private-libsUpgrade libpq-develUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-testUpgrade libpqUpgrade postgresql-private-develUpgrade libpq-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-plpython2Upgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-llvmjit | Sep 30, 2022 | Aug 31, 2022 |
| Centos_linux | — | Upgrade pg_repack-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-upgradeUpgrade postgres-decoderbufs-debugsourceUpgrade postgres-decoderbufsUpgrade postgresql-pltcl-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-private-libs-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-develUpgrade postgresql-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contribUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3Upgrade pgauditUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-docsUpgrade pg_repackUpgrade postgresql-plperlUpgrade postgresql-server-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade postgresql-libsUpgrade postgresql-debugsourceUpgrade postgresql-pltclUpgrade postgresql-staticUpgrade pgaudit-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plpythonUpgrade postgresqlUpgrade postgresql-private-libsUpgrade postgresql-server | May 31, 2022 | May 30, 2022 |
| Debian | — | Upgrade postgresql-13 | May 16, 2022 | May 16, 2022 |
| Freebsd | — | Upgrade postgresql14-serverUpgrade postgresql11-serverUpgrade postgresql12-serverUpgrade postgresql13-serverUpgrade postgresql10-server | Nov 4, 2022 | May 11, 2022 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Nov 23, 2022 | Aug 31, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-plpython | Oct 28, 2022 | Aug 31, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-libs | Aug 18, 2022 | Aug 16, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-develUpgrade postgresql-contrib | Aug 18, 2022 | Aug 16, 2022 |
| Oracle_linux | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-staticUpgrade postgresql-develUpgrade postgresql-upgradeUpgrade postgresql-docsUpgrade pgauditUpgrade postgresql-plpythonUpgrade postgres-decoderbufsUpgrade postgresql-contribUpgrade postgresql-private-develUpgrade postgresql-upgrade-develUpgrade postgresql-libsUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-plpython3Upgrade postgresql-private-libsUpgrade pg_repackUpgrade postgresqlUpgrade postgresql-pltcl | Jun 2, 2022 | May 12, 2022 |
| Postgres | — | Upgrade to PostgreSQL version 14.3Upgrade to the latest version of PostgreSQL | Aug 31, 2022 | Aug 31, 2022 |
| Redhat_linux | — | Upgrade postgresql-private-libs-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade postgresql-private-develUpgrade pgaudit-debugsourceUpgrade postgresql-private-libsUpgrade postgresql-pltclUpgrade pgaudit-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade pg_repack-debuginfoUpgrade postgresqlNo solution existsUpgrade postgresql-plpythonUpgrade pg_repackUpgrade postgresql-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-plperl-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade pgauditUpgrade postgresql-staticUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-libsUpgrade postgresql-contrib-debuginfo | May 31, 2022 | May 30, 2022 |
| Rocky_linux | — | Upgrade pg_repack-debugsourceUpgrade pgauditUpgrade postgresql-plpython3Upgrade postgres-decoderbufsUpgrade postgresql-contrib-debuginfoUpgrade postgresql-testUpgrade postgresql-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-private-develUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-staticUpgrade pgaudit-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-test-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-pltclUpgrade pgaudit-debugsourceUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-plperlUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-contribUpgrade pg_repackUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-docs-debuginfo | Mar 12, 2024 | Aug 31, 2022 |
| Suse | — | Upgrade postgresql12-llvmjitUpgrade postgresql10-pltclUpgrade postgresql12Upgrade postgresql-server-develUpgrade postgresql13-contribUpgrade postgresql12-develUpgrade libecpg6-32bitUpgrade postgresql13-pltclUpgrade postgresql14-server-develUpgrade postgresql14-serverUpgrade postgresql14-pltclUpgrade postgresql14-testUpgrade postgresql10-contribUpgrade postgresql-serverUpgrade postgresql12-plpythonUpgrade postgresql-plpythonUpgrade postgresql14-llvmjit-develUpgrade libpq5Upgrade postgresql13-server-develUpgrade postgresql12-server-develUpgrade postgresql13-llvmjit-develUpgrade postgresql13-develUpgrade postgresql-plperlUpgrade postgresql12-testUpgrade postgresql14-docsUpgrade postgresql12-llvmjit-develUpgrade postgresql10-testUpgrade libecpg6Upgrade postgresqlUpgrade postgresql10-llvmjit-develUpgrade postgresql10-plpythonUpgrade postgresql12-plperlUpgrade postgresql10-plperlUpgrade postgresql14Upgrade postgresql10-serverUpgrade postgresql-develUpgrade postgresql13Upgrade postgresql12-docsUpgrade libpq5-32bitUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql10-docsUpgrade postgresql15Upgrade postgresql13-docsUpgrade postgresql13-llvmjitUpgrade postgresql13-testUpgrade postgresql13-plperlUpgrade postgresql13-serverUpgrade postgresql10-develUpgrade postgresql14-develUpgrade postgresql12-pltclUpgrade postgresql14-plpythonUpgrade postgresql12-contribUpgrade postgresql12-serverUpgrade postgresql14-llvmjitUpgrade postgresql14-plperlUpgrade postgresql13-plpythonUpgrade postgresql14-devel-miniUpgrade postgresql14-contribUpgrade postgresql10Upgrade postgresql-contrib | Oct 26, 2022 | Aug 31, 2022 |
| Ubuntu | — | Upgrade postgresql-13Upgrade postgresql-9.5 (Ubuntu Pro)Upgrade postgresql-10Upgrade postgresql-14Upgrade postgresql-12 | May 25, 2022 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub