Improper Authorization in PostgreSQL - CVE-2020-1720

Vulnerability identifier: #VU25333

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-1720

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform unauthorized modification of data in database.

The vulnerability exists due to the ALTER ... DEPENDS ON EXTENSION sub-commands do not perform authorization checks, which can allow an unprivileged user to drop any function, procedure, materialized view, index, or trigger under certain conditions. This attack is possible if an administrator has installed an extension and an unprivileged user can CREATE, or an extension owner either executes DROP EXTENSION predictably or can be convinced to execute DROP EXTENSION.

PostgreSQL
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Opensuse
openEuler
postgresql (Alpine package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
postgresql-9.6 (Debian package)
postgresql-10 (Ubuntu package)
rh-postgresql10-postgresql (Red Hat package)
postgresql-11 (Debian package)
postgresql-11 (Ubuntu package)
rh-postgresql96-postgresql (Red Hat package)
postgresql-debuginfo
postgresql-test-rpm-macros
postgresql-test
postgresql-static
postgresql-server
postgresql-pltcl
postgresql-plpython3
postgresql-plperl
postgresql-libs
postgresql-help
postgresql-devel
postgresql-debugsource
postgresql-contrib
postgresql
rh-postgresql12-postgresql (Red Hat package)
Red Hat Software Collections
BIG-IQ Centralized Management
Zoho ManageEngine OpManager

Install updates from vendor's website.

PostgreSQL - addressed in versions 9.6.17, 10.12, 11.7, 12.2
postgresql-9.6 (Debian package) - update to 9.6.17-0+deb9u1
postgresql (Alpine package) - addressed in versions 10.12-r0, 11.7-r0
postgresql-10 (Ubuntu package) - update to 10.12-0ubuntu0.18.04.1
rh-postgresql10-postgresql (Red Hat package) - update to 10.12-2.el7
postgresql-11 (Debian package) - update to 11.7-0+deb10u1
postgresql-11 (Ubuntu package) - update to 11.7-0ubuntu0.19.10.1
Zoho ManageEngine OpManager - update to 12.5 125127
rh-postgresql96-postgresql (Red Hat package) - update to 9.6.19-1.el7
postgresql-debuginfo - update to 10.5-15
postgresql-test-rpm-macros - update to 10.5-15
postgresql-test - update to 10.5-15
postgresql-static - update to 10.5-15
postgresql-server - update to 10.5-15
postgresql-pltcl - update to 10.5-15
postgresql-plpython3 - update to 10.5-15
postgresql-plperl - update to 10.5-15
postgresql-libs - update to 10.5-15
postgresql-help - update to 10.5-15
postgresql-devel - update to 10.5-15
postgresql-debugsource - update to 10.5-15
postgresql-contrib - update to 10.5-15
postgresql - update to 10.5-15
rh-postgresql12-postgresql (Red Hat package) - update to 12.4-1.el7

• https://www.postgresql.org/about/news/2011/

• Improper authorization in PostgreSQL
• Debian update for postgresql-9.6
• Debian update for postgresql-11
• Ubuntu update for PostgreSQL
• OpenSUSE Linux update for postgresql10
• Gentoo update for PostgreSQL
• Red Hat Software Collections update for rh-postgresql10-postgresql
• Path traversal and bundled PostgreSQL vulnerabilities in Zoho ManageEngine OpManager
• OpenSUSE Linux update for postgresql96, postgresql10 and postgresql12
• Improper Authorization in postgresql (Alpine package)
• Amazon Linux AMI update for postgresql96
• Red Hat Software Collections update for rh-postgresql12-postgresql
• Red Hat Enterprise Linux 8 update for the postgresql:9.6 module
• Red Hat Enterprise Linux 8 update for the postgresql:12 module
• Red Hat Enterprise Linux 8 update for the postgresql:9.6 module
• Red Hat Enterprise Linux 8 update for the postgresql:10 module
• Red Hat Enterprise Linux 8.2 update for the postgresql:12 module
• Red Hat Enterprise Linux 8.2 update for the postgresql:9.6 module
• Red Hat Enterprise Linux 8.1 update for the postgresql:10 module
• Red Hat Enterprise Linux 8.1 update for the postgresql:9.6 module
• Red Hat Software Collections update for rh-postgresql96-postgresql
• openEuler 20.03 LTS update for postgresql-10.5-15
• Improper authorization in F5 BIG-IQ Centralized Management PostgreSQL component
• Red Hat Enterprise Linux 8 update for the postgresql:10 module