PT-2020-5313 · Postgresql+8 · Postgresql+8
Andres Freund
·
Published
2020-08-12
·
Updated
2026-01-30
·
CVE-2020-14350
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PostgreSQL versions prior to 12.4
PostgreSQL versions prior to 11.9
PostgreSQL versions prior to 10.14
PostgreSQL versions prior to 9.6.19
PostgreSQL versions prior to 9.5.23
Description
The issue is related to PostgreSQL extensions not using the search path safely in their installation scripts. This could allow an attacker with sufficient privileges to trick an administrator into executing a specially crafted script during the installation or update of such an extension, potentially leading to unauthorized access to confidential data, disruption of data integrity, and denial of service.
Recommendations
For versions prior to 12.4, update to version 12.4 or later.
For versions prior to 11.9, update to version 11.9 or later.
For versions prior to 10.14, update to version 10.14 or later.
For versions prior to 9.6.19, update to version 9.6.19 or later.
For versions prior to 9.5.23, update to version 9.5.23 or later.
Fix
Untrusted Search Path
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Postgresql
Red Hat
Rocky Linux
Suse
Ubuntu