3.5
CVSSv2

CVE-2020-1720

Published: 17/03/2020 Updated: 07/11/2023
CVSS v2 Base Score: 3.5 | Impact Score: 2.9 | Exploitability Score: 6.8
CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8
VMScore: 312
Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N

Vulnerability Summary

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions prior to 12.2, prior to 11.7, prior to 10.12 and prior to 9.6.17.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

postgresql postgresql

redhat decision manager 7.0

redhat enterprise linux 8.0

redhat software collections -

Vendor Advisories

PostgreSQL could allow unintended access to the database ...
Tom Lane discovered that ALTER DEPENDS ON EXTENSION sub commands in the PostgreSQL database did not perform authorisation checks For the stable distribution (buster), this problem has been fixed in version 117-0+deb10u1 We recommend that you upgrade your postgresql-11 packages For the detailed security status of postgresql-11 please refer t ...
Tom Lane discovered that ALTER DEPENDS ON EXTENSION sub commands in the PostgreSQL database did not perform authorisation checks For the oldstable distribution (stretch), this problem has been fixed in version 9617-0+deb9u1 We recommend that you upgrade your postgresql-96 packages For the detailed security status of postgresql-96 please ...
PostgreSQL maintains column statistics for tables Certain statistics, such as histograms and lists of most common values, contain values taken from the column PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns ...
Synopsis Important: postgresql:96 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:96 module is now available for Red Hat Enterprise Linux 82 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Com ...
Synopsis Important: postgresql:10 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:10 module is now available for Red Hat Enterprise Linux 81 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Commo ...
Synopsis Moderate: postgresql:10 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for the postgresql:10 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability S ...
Synopsis Important: postgresql:96 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:96 module is now available for Red Hat Enterprise Linux 81 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Com ...
Synopsis Moderate: rh-postgresql12-postgresql security update Type/Severity Security Advisory: Moderate Topic An update for rh-postgresql12-postgresql is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerabil ...
Synopsis Moderate: rh-postgresql96-postgresql security update Type/Severity Security Advisory: Moderate Topic An update for rh-postgresql96-postgresql is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerabil ...
Synopsis Important: postgresql:12 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sy ...
Synopsis Important: postgresql:10 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:10 module is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Importan ...
Synopsis Important: postgresql:12 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 82 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Commo ...
Synopsis Important: postgresql:96 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:96 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring ...
Synopsis Important: postgresql:96 security update Type/Severity Security Advisory: Important Topic An update for the postgresql:96 module is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Import ...
Synopsis Moderate: rh-postgresql10-postgresql security update Type/Severity Security Advisory: Moderate Topic An update for rh-postgresql10-postgresql is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerabil ...
The ALTER DEPENDS ON EXTENSION sub-commands do not perform authorization checks, which can allow an unprivileged user to drop any function, procedure, materialized view, index, or trigger under certain conditions This attack is possible if an administrator has installed an extension and an unprivileged user can CREATE, or an extension owner e ...