7.3
CVSSv3

CVE-2020-14350

Published: 24/08/2020 Updated: 24/01/2023
CVSS v2 Base Score: 4.4 | Impact Score: 6.4 | Exploitability Score: 3.4
CVSS v3 Base Score: 7.3 | Impact Score: 5.9 | Exploitability Score: 1.3
VMScore: 392
Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions prior to 12.4, prior to 11.9, prior to 10.14, prior to 9.6.19, and prior to 9.5.23.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

postgresql postgresql

debian debian linux 9.0

opensuse leap 15.1

opensuse leap 15.2

canonical ubuntu linux 18.04

canonical ubuntu linux 20.04

canonical ubuntu linux 16.04

Vendor Advisories

Synopsis Moderate: rh-postgresql10-postgresql security update Type/Severity Security Advisory: Moderate Topic An update for rh-postgresql10-postgresql is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerabil ...
Synopsis Important: postgresql:96 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:96 module is now available for Red Hat Enterprise Linux 82 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Com ...
Synopsis Important: postgresql:10 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:10 module is now available for Red Hat Enterprise Linux 81 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Commo ...
Synopsis Moderate: postgresql:10 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for the postgresql:10 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability S ...
Synopsis Important: postgresql:96 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:96 module is now available for Red Hat Enterprise Linux 81 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Com ...
Synopsis Moderate: rh-postgresql12-postgresql security update Type/Severity Security Advisory: Moderate Topic An update for rh-postgresql12-postgresql is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerabil ...
Synopsis Moderate: rh-postgresql96-postgresql security update Type/Severity Security Advisory: Moderate Topic An update for rh-postgresql96-postgresql is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerabil ...
Synopsis Important: postgresql:12 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sy ...
Synopsis Important: postgresql:10 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:10 module is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Importan ...
Synopsis Important: postgresql:12 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 82 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Commo ...
Synopsis Important: postgresql:96 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:96 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring ...
Synopsis Important: postgresql:96 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:96 module is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Import ...
PostgreSQL maintains column statistics for tables Certain statistics, such as histograms and lists of most common values, contain values taken from the column PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns ...
PostgreSQL maintains column statistics for tables Certain statistics, such as histograms and lists of most common values, contain values taken from the column PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns ...
When a superuser runs certain CREATE EXTENSION statements, users may be able to execute arbitrary SQL functions under the identity of that superuser The attacker must have permission to create objects in the new extension's schema or a schema of a prerequisite extension Not all extensions are vulnerable ...