Untrusted search path in PostgreSQL - CVE-2020-14349

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU45748

Untrusted search path in PostgreSQL - CVE-2020-14349

Published: August 18, 2020


Vulnerability identifier: #VU45748
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-14349
CWE-ID: CWE-426
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to escalate privileges within the database.

The vulnerability exists due to the way PostgreSQL handles search_path during replications. Users of a replication publisher or subscriber database can create objects in the public schema and harness them to execute arbitrary SQL functions under the identity running replication, often a superuser.


Affected software

PostgreSQL
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Opensuse
Ubuntu
openEuler
Fedora
postgresql (Alpine package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
rh-postgresql10-postgresql (Red Hat package)
rhvm-appliance (Red Hat package)
postgresql-9.5 (Ubuntu package)
postgresql-libs
postgresql-test-rpm-macros
postgresql-test
postgresql-static
postgresql-server
postgresql-pltcl
postgresql-plpython3
postgresql-plperl
postgresql-help
postgresql-devel
postgresql-debuginfo
postgresql-contrib
postgresql
postgresql-debugsource
postgresql-10 (Ubuntu package)
postgresql-12 (Ubuntu package)
rh-postgresql12-postgresql (Red Hat package)
Red Hat Software Collections
Zoho ManageEngine OpManager
EMC Data Protection Advisor
EMC NetWorker Server

How to mitigate CVE-2020-14349

Install updates from vendor's website.

PostgreSQL - addressed in versions 10.14, 11.9, 12.4
postgresql (Alpine package) - update to 12.4-r0
rh-postgresql10-postgresql (Red Hat package) - update to 10.14-1.el7
Zoho ManageEngine OpManager - update to 12.5 125397
rhvm-appliance (Red Hat package) - update to 4.4-20210310.0.el8ev
postgresql-9.5 (Ubuntu package) - update to 9.5.23-0ubuntu0.16.04.1
postgresql-libs - update to 10.5-18
postgresql-test-rpm-macros - update to 10.5-18
postgresql-test - update to 10.5-18
postgresql-static - update to 10.5-18
postgresql-server - update to 10.5-18
postgresql-pltcl - update to 10.5-18
postgresql-plpython3 - update to 10.5-18
postgresql-plperl - update to 10.5-18
postgresql-help - update to 10.5-18
postgresql-devel - update to 10.5-18
postgresql-debuginfo - update to 10.5-18
postgresql-contrib - update to 10.5-18
postgresql - update to 10.5-18
postgresql-debugsource - update to 10.5-18
postgresql-10 (Ubuntu package) - update to 10.14-0ubuntu0.18.04.1
postgresql - addressed in versions 10-3220210113115521.43bbeeef, 10-3320210113115521.601d93de, 11-3220210113151114.43bbeeef, 11-3320210114142718.601d93de, 12-3320210119180006.601d93de
postgresql-12 (Ubuntu package) - update to 12.4-0ubuntu0.20.04.1
rh-postgresql12-postgresql (Red Hat package) - update to 12.4-1.el7
EMC Data Protection Advisor - addressed in versions 19.4.0 B21, 19.5
EMC NetWorker Server - addressed in versions 19.6.1.3, 19.7.0.1

External References

Related Security Bulletins