vulnerability

Rocky Linux: CVE-2020-14349: postgresql-12 (RLSA-2020-5620)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:H/Au:S/C:P/I:P/A:P)

Published

Aug 24, 2020

Added

Mar 12, 2024

Modified

Mar 31, 2026

Description

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.

Solutions

rocky-upgrade-pgauditrocky-upgrade-pgaudit-debuginforocky-upgrade-pgaudit-debugsourcerocky-upgrade-postgres-decoderbufsrocky-upgrade-postgres-decoderbufs-debuginforocky-upgrade-postgres-decoderbufs-debugsource

References

CVE-2020-14349
https://attackerkb.com/topics/CVE-2020-14349
CWE-427
CWE-89
EUVD-EUVD-2020-6493
https://errata.rockylinux.org/RLSA-2020:5620
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-6493

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report