Noah Misch

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions prior to 17.6 PostgreSQL versions prior to 16.10 PostgreSQL versions prior to 15.14 PostgreSQL versions prior to 14.19 PostgreSQL versions prior to 13.22 Description: Improper neutralization of newlines in `pg dump` allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running `psql` to restore the dump, via `psql` meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. `pg dumpall`, `pg restore`, and `pg upgrade` are also affected. Recommendations: Update to PostgreSQL version 17.6 or later. Update to PostgreSQL version 16.10 or later. Update to PostgreSQL version 15.14 or later. Update to PostgreSQL version 14.19 or later. Update to PostgreSQL version 13.22 or later.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions prior to 16.4 PostgreSQL versions prior to 15.8 PostgreSQL versions prior to 14.13 PostgreSQL versions prior to 13.16 PostgreSQL versions prior to 12.20 **Description** A Time-of-check Time-of-use (TOCTOU) race condition in pg dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Approximately 3,929,844 devices are potentially affected, mainly distributed in the United States, Germany, and other countries. **Recommendations** For versions prior to 16.4, upgrade to version 16.4 or later. For versions prior to 15.8, upgrade to version 15.8 or later. For versions prior to 14.13, upgrade to version 14.13 or later. For versions prior to 13.16, upgrade to version 13.16 or later. For versions prior to 12.20, upgrade to version 12.20 or later. As a temporary workaround, consider restricting access to the pg dump utility until a patch is available. Avoid using the pg dump utility with open transactions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions prior to 10.14 PostgreSQL versions prior to 11.9 PostgreSQL versions prior to 12.4 **Description** The issue is related to the improper sanitization of the `search path` during logical replication in PostgreSQL, allowing an authenticated attacker to execute arbitrary SQL commands in the context of the user used for replication. This could potentially lead to privilege escalation and the execution of arbitrary commands. **Recommendations** For versions prior to 10.14, update to version 10.14 or later to resolve the issue. For versions prior to 11.9, update to version 11.9 or later to resolve the issue. For versions prior to 12.4, update to version 12.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** postgresql versions 11.x prior to 11.3 **Description** A vulnerability was found in the Windows installer for EnterpriseDB-supplied PostgreSQL, which does not lock down the ACL of the binary installation directory or the ACL of the data directory, keeping the inherited ACL. This allows a local attacker to read arbitrary data directory files, essentially bypassing database-imposed read access limitations. In non-default configurations, an attacker with both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code. **Recommendations** For postgresql versions 11.x prior to 11.3, consider updating to version 11.3 or later to resolve the issue. As a temporary workaround, restrict access to the data directory and binary installation directory to minimize the risk of exploitation. Additionally, review and adjust the ACL settings for these directories to ensure proper access control.

Name of the Vulnerable Software and Affected Versions: Postgresql versions prior to 11.5 Postgresql versions prior to 10.10 Postgresql versions prior to 9.6.15 Postgresql versions prior to 9.5.19 Postgresql versions prior to 9.4.24 Description: The issue allows a superuser to write a password to an unprotected temporary file. Recommendations: For versions prior to 11.5, update to version 11.5 or later. For versions prior to 10.10, update to version 10.10 or later. For versions prior to 9.6.15, update to version 9.6.15 or later. For versions prior to 9.5.19, update to version 9.5.19 or later. For versions prior to 9.4.24, update to version 9.4.24 or later.

**Name of the Vulnerable Software and Affected Versions** postgresql versions 11.x prior to 11.3 **Description** A vulnerability allows an attacker to read arbitrary bytes of server memory by using a specially crafted insert to a partitioned table. In the default configuration, any user can create a partitioned table suitable for this attack. **Recommendations** For postgresql versions 11.x prior to 11.3, update to version 11.3 or later to resolve the issue. As a temporary workaround, consider restricting access to create partitioned tables to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions prior to 9.1.23 PostgreSQL versions 9.2.x prior to 9.2.18 PostgreSQL versions 9.3.x prior to 9.3.14 PostgreSQL versions 9.4.x prior to 9.4.9 PostgreSQL versions 9.5.x prior to 9.5.4 **Description** The issue allows remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a mishandled database or role name that contains specific characters, including a double quote, backslash, carriage return, or newline character, during an administrative operation. **Recommendations** For versions prior to 9.1.23, update to version 9.1.23 or later. For versions 9.2.x prior to 9.2.18, update to version 9.2.18 or later. For versions 9.3.x prior to 9.3.14, update to version 9.3.14 or later. For versions 9.4.x prior to 9.4.9, update to version 9.4.9 or later. For versions 9.5.x prior to 9.5.4, update to version 9.5.4 or later.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions prior to 9.1.20 PostgreSQL versions 9.2.x prior to 9.2.15 PostgreSQL versions 9.3.x prior to 9.3.11 PostgreSQL versions 9.4.x prior to 9.4.6 PostgreSQL versions 9.5.x prior to 9.5.1 **Description** The issue is related to improper access restriction to custom configuration settings (GUCS) for PL/Java in PostgreSQL, allowing attackers to gain privileges via unspecified vectors. This can be exploited by a remote attacker to elevate their privileges. **Recommendations** For versions prior to 9.1.20, update to version 9.1.20 or later. For versions 9.2.x prior to 9.2.15, update to version 9.2.15 or later. For versions 9.3.x prior to 9.3.11, update to version 9.3.11 or later. For versions 9.4.x prior to 9.4.6, update to version 9.4.6 or later. For versions 9.5.x prior to 9.5.1, update to version 9.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions prior to 9.0.20 PostgreSQL versions 9.1.x prior to 9.1.16 PostgreSQL versions 9.2.x prior to 9.2.11 PostgreSQL versions 9.3.x prior to 9.3.7 PostgreSQL versions 9.4.x prior to 9.4.2 **Description** The issue allows attackers to obtain the key via a brute force attack due to different error responses when an incorrect key is used for decryption. This is related to the `pgcrypto` module in PostgreSQL. **Recommendations** For versions prior to 9.0.20, update to version 9.0.20 or later. For versions 9.1.x prior to 9.1.16, update to version 9.1.16 or later. For versions 9.2.x prior to 9.2.11, update to version 9.2.11 or later. For versions 9.3.x prior to 9.3.7, update to version 9.3.7 or later. For versions 9.4.x prior to 9.4.2, update to version 9.4.2 or later.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions prior to 9.0.20 PostgreSQL versions 9.1.x prior to 9.1.16 PostgreSQL versions 9.2.x prior to 9.2.11 PostgreSQL versions 9.3.x prior to 9.3.7 PostgreSQL versions 9.4.x prior to 9.4.2 **Description** The issue is related to the snprintf implementation, which does not properly handle system-call errors. This can allow attackers to obtain sensitive information or have other unspecified impact via unknown vectors, such as an out-of-memory error. **Recommendations** For versions prior to 9.0.20, update to version 9.0.20 or later. For versions 9.1.x prior to 9.1.16, update to version 9.1.16 or later. For versions 9.2.x prior to 9.2.11, update to version 9.2.11 or later. For versions 9.3.x prior to 9.3.7, update to version 9.3.7 or later. For versions 9.4.x prior to 9.4.2, update to version 9.4.2 or later.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions 9.0.0 through 9.0.18 PostgreSQL versions 9.1.x before 9.1.15 PostgreSQL versions 9.2.x before 9.2.10 PostgreSQL versions 9.3.x before 9.3.6 PostgreSQL versions 9.4.x before 9.4.1 **Description** The issue is related to multiple buffer overflows in the contrib/pgcrypto module of PostgreSQL, allowing remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors. This is due to memory errors in functions within the pgcrypto extension. **Recommendations** For PostgreSQL versions 9.0.0 through 9.0.18, update to version 9.0.19 or later. For PostgreSQL versions 9.1.x before 9.1.15, update to version 9.1.15 or later. For PostgreSQL versions 9.2.x before 9.2.10, update to version 9.2.10 or later. For PostgreSQL versions 9.3.x before 9.3.6, update to version 9.3.6 or later. For PostgreSQL versions 9.4.x before 9.4.1, update to version 9.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions 8.3 through 8.3.19 PostgreSQL versions 8.4 through 8.4.12 PostgreSQL versions 9.0 through 9.0.8 PostgreSQL versions 9.1 through 9.1.4 **Description** The issue allows remote attackers to determine the existence of arbitrary files or URLs and possibly obtain the file or URL content that triggers a parsing error. This is related to an XML External Entity (XXE) issue, where the `xml parse` function in the libxml2 support can be exploited through an XML value that refers to (1) a DTD or (2) an entity. **Recommendations** For PostgreSQL versions 8.3 through 8.3.19, update to version 8.3.20 or later. For PostgreSQL versions 8.4 through 8.4.12, update to version 8.4.13 or later. For PostgreSQL versions 9.0 through 9.0.8, update to version 9.0.9 or later. For PostgreSQL versions 9.1 through 9.1.4, update to version 9.1.5 or later.

**Name of the Vulnerable Software and Affected Versions** PostgreSQL versions 9.2.x through 9.2.3 PostgreSQL versions 9.1.x through 9.1.8 **Description** The issue allows remote authenticated users to bypass intended backup restrictions. This can be achieved by calling the (1) pg start backup or (2) pg stop backup functions. An unprivileged user can run commands that could interfere with in-progress backups. The vulnerability may lead to a violation of confidentiality, integrity, and availability of protected information and can be exploited remotely by an authenticated attacker. **Recommendations** For PostgreSQL versions 9.2.x through 9.2.3, update to version 9.2.4 or later. For PostgreSQL versions 9.1.x through 9.1.8, update to version 9.1.9 or later. As a temporary workaround, consider restricting access to the pg start backup and pg stop backup functions until a patch is available.