PT-2021-21961 · Postgresql · Postgresql Set User Extension Module

Published 2021-08-10 · Updated 2021-08-17 · CVE-2021-38140

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: PostgreSQL set user extension module versions prior to 2.0.1

Description: The issue allows a potential privilege escalation using RESET SESSION AUTHORIZATION after set user(). This can be exploited to gain elevated privileges.

Recommendations: For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the set user extension module until a patch is applied. Avoid using the RESET SESSION AUTHORIZATION command after set user() in the affected API endpoint until the issue is resolved.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2021-38140

Affected Products

Postgresql Set User Extension Module

References · 5

• https://github.com/pgaudit/set_user/compare/REL2_0_0...REL2_0_1 · Patch
• https://osv.dev/vulnerability/CVE-2021-38140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38140 · Security Note
• https://github.com/pgaudit/set_user/releases/tag/REL2_0_1 · Note
• https://t.me/cvenotify/19011 · Telegram Post