SB2020102810 - Amazon Linux AMI update for postgresql95
Published: October 28, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-10130)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to incorrect implementation of row security policies. A remote attacker can use statistics, generated for tables to bypass row security policies and gain access to restricted rows.
2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-10208)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to way PostreSQL processes SECURITY DEFINER functions. A privileged attacker with EXECUTE permission, which must itself contain a function call having inexact argument type match, can execute arbitrary SQL query under the identity of the function owner.
3) Untrusted search path (CVE-ID: CVE-2020-14350)
The vulnerability allows a remote user to escalate privileges within the database.
The vulnerability exists due to the way PostgreSQL handles CREATE EXTENSION statements. A remote user with permission to create objects in the new extension's schema
or a schema of a prerequisite extension can execute arbitrary SQL functions under the identity of the superuser in certain cases.
Remediation
Install update from vendor's website.