It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Aug 24, 2020 |
| Alpine Linux | — | Upgrade postgresql12Upgrade postgresql14Upgrade postgresqlUpgrade postgresql15 | Sep 23, 2020 | Aug 24, 2020 |
| Amazon_linux | — | Upgrade postgresql96Upgrade postgresql95 | Oct 28, 2020 | Aug 17, 2020 |
| Centos_linux | — | Upgrade postgresql-testUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-staticUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-debugsourceUpgrade postgresqlUpgrade postgresql-plpython3Upgrade postgres-decoderbufsUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-test-debuginfoUpgrade pgauditUpgrade postgresql-docsUpgrade postgresql-plperl-debuginfoUpgrade postgresql-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server | Sep 9, 2020 | Aug 24, 2020 |
| Debian | — | Upgrade postgresql-11 | Aug 21, 2020 | Aug 21, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 27, 2020 | Aug 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-plpythonUpgrade postgresql-develUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-docs | Sep 29, 2020 | Aug 24, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-staticUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-plperlUpgrade postgres-decoderbufsUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-develUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade pgauditUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-testUpgrade postgresql-upgrade-develUpgrade postgresqlUpgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-server | Sep 10, 2020 | Aug 13, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 12.4 | Aug 17, 2020 | Aug 17, 2020 |
| Redhat_linux | — | Upgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-plpython3-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-devel-debuginfoNo solution existsUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-contribUpgrade postgresql-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-upgrade-debuginfoUpgrade postgresql-upgradeUpgrade pgaudit-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-docsUpgrade postgresql-debuginfoUpgrade pgauditUpgrade postgresql-pltcl-debuginfoUpgrade postgresqlUpgrade postgres-decoderbufsUpgrade postgresql-staticUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-test | Sep 9, 2020 | Aug 24, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfoUpgrade pgaudit-debugsourceUpgrade pgauditUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufs | Mar 12, 2024 | Aug 24, 2020 |
| Suse | — | Upgrade postgresql-pltclUpgrade postgresql12-docsUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql10-testUpgrade postgresql-server-develUpgrade postgresql-plpythonUpgrade libecpg6Upgrade libpq5Upgrade postgresqlUpgrade libpq5-32bitUpgrade postgresql12-llvmjitUpgrade postgresql10Upgrade postgresql-plperlUpgrade postgresql10-serverUpgrade libecpg6-32bitUpgrade postgresql11-server-develUpgrade postgresql12-serverUpgrade postgresql10-contribUpgrade postgresql12Upgrade postgresql11-serverUpgrade postgresql11-llvmjitUpgrade postgresql96-plperlUpgrade postgresql96-develUpgrade postgresql11-develUpgrade postgresql10-docsUpgrade postgresql12-plpythonUpgrade postgresql-develUpgrade postgresql96Upgrade postgresql11-plpythonUpgrade postgresql96-pltclUpgrade postgresql11-docsUpgrade postgresql11-testUpgrade postgresql12-plperlUpgrade postgresql-llvmjitUpgrade postgresql10-plperlUpgrade postgresql11Upgrade postgresql96-serverUpgrade postgresql-docsUpgrade postgresql11-pltclUpgrade postgresql96-docsUpgrade postgresql10-pltclUpgrade postgresql10-plpythonUpgrade postgresql11-plperlUpgrade postgresql96-plpythonUpgrade postgresql10-develUpgrade postgresql12-server-develUpgrade postgresql-contribUpgrade postgresql96-testUpgrade postgresql11-contribUpgrade postgresql12-develUpgrade postgresql12-contribUpgrade postgresql12-testUpgrade postgresql12-pltclUpgrade postgresql96-contrib | Aug 18, 2020 | Aug 17, 2020 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-9.5Upgrade postgresql-12 | Aug 26, 2020 | Aug 17, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub