A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-upgradeUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade postgresql-contribUpgrade pg_repackUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgres-decoderbufsUpgrade postgresqlUpgrade postgresql-testUpgrade pgauditUpgrade postgresql-docs | Jun 7, 2022 | May 30, 2022 |
| Alpine Linux | — | Upgrade postgresql13Upgrade postgresql15Upgrade postgresql14Upgrade postgresqlUpgrade postgresql12 | Aug 22, 2024 | Aug 31, 2022 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-upgrade-develUpgrade postgresql-plpython2Upgrade postgresql-plpythonUpgrade postgresql-test-rpm-macrosUpgrade postgresql-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-llvmjitUpgrade postgresql-develUpgrade postgresql-server-develUpgrade postgresql-private-develUpgrade postgresql-plpython3Upgrade libpqUpgrade postgresql-serverUpgrade postgresql-libsUpgrade libpq-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-private-libsUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-staticUpgrade libpq-develUpgrade postgresql-docs | Sep 30, 2022 | Aug 31, 2022 |
| Centos_linux | — | Upgrade postgresql-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-testUpgrade postgresql-plperl-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-staticUpgrade postgresql-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-serverUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-libsUpgrade postgresql-private-libsUpgrade postgresql-plperlUpgrade pg_repackUpgrade postgresql-docsUpgrade postgresql-server-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresqlUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-private-libs-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufsUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufs-debugsourceUpgrade pg_repack-debugsourceUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgradeUpgrade pgauditUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-docs-debuginfo | May 31, 2022 | May 30, 2022 |
| Debian | — | Upgrade postgresql-13 | May 16, 2022 | May 16, 2022 |
| Freebsd | — | Upgrade postgresql13-serverUpgrade postgresql12-serverUpgrade postgresql14-serverUpgrade postgresql11-serverUpgrade postgresql10-server | Nov 4, 2022 | May 11, 2022 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Nov 23, 2022 | Aug 31, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-test | Oct 28, 2022 | Aug 31, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-develUpgrade postgresql-serverUpgrade postgresql-libs | Aug 18, 2022 | Aug 16, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-libsUpgrade postgresql-plpythonUpgrade postgresql-pltcl | Aug 18, 2022 | Aug 16, 2022 |
| Oracle_linux | — | Upgrade postgresql-plpythonUpgrade pgauditUpgrade postgres-decoderbufsUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-private-develUpgrade postgresql-upgrade-develUpgrade postgresql-upgradeUpgrade postgresql-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-staticUpgrade postgresql-pltclUpgrade pg_repackUpgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-private-libs | Jun 2, 2022 | May 12, 2022 |
| Postgres | — | Upgrade to PostgreSQL version 14.3 | Aug 31, 2022 | Aug 31, 2022 |
| Redhat_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade pg_repack-debugsourceUpgrade pgauditUpgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-develUpgrade postgresql-plperl-debuginfoUpgrade postgresql-serverUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-libsUpgrade postgresql-server-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-plperlUpgrade postgresql-upgrade-devel-debuginfoUpgrade pg_repackNo solution existsUpgrade pgaudit-debugsourceUpgrade postgresql-pltclUpgrade pgaudit-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-private-develUpgrade postgresql-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpythonUpgrade postgresql-server-devel | May 31, 2022 | May 30, 2022 |
| Rocky_linux | — | Upgrade postgresql-docs-debuginfoUpgrade pg_repack-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pg_repackUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade pgauditUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade postgresql-testUpgrade pg_repack-debugsourceUpgrade postgresql-private-develUpgrade postgres-decoderbufsUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-server-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-test-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-private-libsUpgrade pgaudit-debuginfoUpgrade postgresql-serverUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfo | Mar 12, 2024 | Aug 31, 2022 |
| Suse | — | Upgrade postgresql14-contribUpgrade postgresql13-serverUpgrade postgresql13-llvmjitUpgrade postgresql14-devel-miniUpgrade libpq5-32bitUpgrade postgresql14-plpythonUpgrade postgresql10-develUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresql10-docsUpgrade postgresql13-plperlUpgrade postgresql15Upgrade postgresql13-testUpgrade postgresql10Upgrade postgresql14Upgrade postgresql-contribUpgrade postgresql12-serverUpgrade postgresql14-llvmjitUpgrade postgresql12-docsUpgrade postgresql13-plpythonUpgrade postgresql13Upgrade postgresql13-docsUpgrade postgresql14-develUpgrade postgresql14-plperlUpgrade postgresql10-serverUpgrade postgresql12-pltclUpgrade postgresql12-contribUpgrade postgresql-develUpgrade postgresql12Upgrade postgresql13-contribUpgrade postgresql-serverUpgrade postgresql13-llvmjit-develUpgrade postgresql10-contribUpgrade postgresql-server-develUpgrade postgresql13-pltclUpgrade postgresql14-llvmjit-develUpgrade libecpg6Upgrade postgresql10-plperlUpgrade postgresql-plperlUpgrade libecpg6-32bitUpgrade postgresql12-server-develUpgrade postgresql10-llvmjit-develUpgrade postgresql10-testUpgrade postgresql12-plpythonUpgrade postgresql12-llvmjit-develUpgrade postgresql13-develUpgrade postgresqlUpgrade postgresql14-serverUpgrade postgresql13-server-develUpgrade postgresql12-plperlUpgrade postgresql10-plpythonUpgrade postgresql14-server-develUpgrade postgresql12-llvmjitUpgrade postgresql12-develUpgrade postgresql10-pltclUpgrade postgresql12-testUpgrade postgresql14-docsUpgrade libpq5Upgrade postgresql14-testUpgrade postgresql14-pltclUpgrade postgresql-plpython | Oct 26, 2022 | Aug 31, 2022 |
| Ubuntu | — | Upgrade postgresql-14Upgrade postgresql-12Upgrade postgresql-10Upgrade postgresql-13Upgrade postgresql-9.5 (Ubuntu Pro) | May 25, 2022 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub