Permissions, Privileges, and Access Controls in PostgreSQL - CVE-2022-2625

Vulnerability identifier: #VU66429

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-2625

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges within the database.

The vulnerability exists due to extension scripts can replace objects that do not belong to the extension when using the CREATE OR REPLACE or CREATE IF NOT EXISTS commands. A remote user with (1) permissions to create non-temporary objects in at least one schema, (2) ability to lure or wait for an administrator to create or update an affected extension in that schema, and (3) ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS can run arbitrary code as the victim role.

PostgreSQL
Gentoo Linux
Oracle Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
SUSE Linux Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
openSUSE Leap
Ubuntu
IBM Security QRadar Network Threat Analytics
PowerStore X
PowerStore T
IBM Data Risk Manager
IBM Spectrum Copy Data Management
Dell Secure Connect Gateway
IBM Sterling Connect:Direct Web Services
IBM Spectrum Protect Plus
IBM Security Verify Governance
IBM Cloud Pak for Business Automation
IBM Qradar SIEM
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
SUSE Linux Enterprise Module for Packagehub Subpackages
postgres-decoderbufs
pgaudit
pg_repack
postgresql-10 (Ubuntu package)
postgresql10-pltcl
postgresql10-devel-debuginfo
postgresql10-devel
postgresql10-server-debuginfo
postgresql10-server
postgresql10-docs
postgresql10
postgresql10-contrib
postgresql10-contrib-debuginfo
postgresql10-debuginfo
postgresql10-debugsource
postgresql10-plperl
postgresql10-plperl-debuginfo
postgresql10-plpython
postgresql10-plpython-debuginfo
postgresql10-pltcl-debuginfo
libecpg6
libpq5-32bit
libpq5-32bit-debuginfo
libpq5-debuginfo
libpq5
libecpg6-debuginfo
postgresql10-llvmjit-devel
postgresql10-test
rh-postgresql10-postgresql (Red Hat package)
postgresql-devel
postgresql-server-devel
postgresql
postgresql-server
postgresql-pltcl
postgresql-plpython
postgresql-contrib
postgresql-plperl
postgresql-docs
postgresql-12 (Ubuntu package)
postgresql-test-rpm-macros
postgresql-plpython3
postgresql-static
postgresql-test
postgresql-upgrade
postgresql-upgrade-devel
postgresql12-plpython
postgresql12-plperl-debuginfo
postgresql12-plperl
postgresql12-debuginfo
postgresql12-contrib-debuginfo
postgresql12-contrib
postgresql12
postgresql12-server-devel-debuginfo
postgresql12-server-devel
postgresql12-devel-debuginfo
postgresql12-devel
postgresql12-debugsource
postgresql12-plpython-debuginfo
postgresql12-pltcl
postgresql12-pltcl-debuginfo
postgresql12-server
postgresql12-server-debuginfo
postgresql12-docs
postgresql12-test
postgresql12-llvmjit
postgresql12-llvmjit-debuginfo
postgresql12-llvmjit-devel
postgresql13-plpython-debuginfo
postgresql13-pltcl
postgresql13-pltcl-debuginfo
postgresql13-server
postgresql13-server-debuginfo
postgresql13-docs
postgresql13-debugsource
postgresql13-plperl-debuginfo
postgresql13-plpython
postgresql13-devel
postgresql13-devel-debuginfo
postgresql13-server-devel
postgresql13-server-devel-debuginfo
postgresql13
postgresql13-contrib
postgresql13-contrib-debuginfo
postgresql13-debuginfo
postgresql13-plperl
postgresql13-llvmjit-devel
postgresql13-llvmjit-debuginfo
postgresql13-llvmjit
postgresql13-test
postgresql (Red Hat package)
postgresql-14 (Ubuntu package)
postgresql14-debugsource
postgresql14-devel
postgresql14-plperl-debuginfo
postgresql14-plperl
postgresql14-debuginfo
postgresql14-contrib-debuginfo
postgresql14-contrib
postgresql14
postgresql14-server-devel-debuginfo
postgresql14-server-devel
postgresql14-devel-debuginfo
postgresql14-server-debuginfo
libpq5-debuginfo-32bit
postgresql14-server
postgresql14-docs
postgresql14-pltcl-debuginfo
postgresql14-pltcl
postgresql14-plpython-debuginfo
postgresql14-plpython
postgresql14-test
libecpg6-32bit
libecpg6-32bit-debuginfo
postgresql14-llvmjit-debuginfo
postgresql14-llvmjit
postgresql14-llvmjit-devel
IBM Storage Scale System
Dell EMC VxRail Appliance
IBM Security Verify Access

Install updates from vendor's website.

PostgreSQL - addressed in versions 10.22, 11.17, 12.12, 13.8, 14.5
IBM Security QRadar Network Threat Analytics - update to 1.4.3
IBM Data Risk Manager - update to 2.0.6.15
IBM Spectrum Copy Data Management - update to 2.2.18
Dell Secure Connect Gateway - update to 5.14.00.10
IBM Sterling Connect:Direct Web Services - addressed in versions 6.0.0.11, 6.1.0.15
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 8, 7.5.0 Update Pack 4
IBM Spectrum Protect Plus - update to 10.1.12.4
postgres-decoderbufs - update to 0.10.0-2
pgaudit - addressed in versions 1.4.0-5, 1.5.0-1
pg_repack - update to 1.4.6-3
PowerStore X - update to 3.2.1.0-1989710
PowerStore T - update to 3.2.1.0-1989710
IBM Storage Scale System - addressed in versions 6.1.2.8, 6.1.9.0
Dell EMC VxRail Appliance - addressed in versions 7.0.401, 8.0.000
IBM Security Verify Governance - update to 10.0.2.0.1
IBM Security Verify Access - update to 10.0.7.0
postgresql-10 (Ubuntu package) - update to 10.22-0ubuntu0.18.04.1
postgresql10-pltcl - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10-devel-debuginfo - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10-devel - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10-server-debuginfo - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10-server - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10-docs - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10 - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10-contrib - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10-contrib-debuginfo - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10-debuginfo - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10-debugsource - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10-plperl - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10-plperl-debuginfo - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10-plpython - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10-plpython-debuginfo - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
postgresql10-pltcl-debuginfo - addressed in versions 10.22-4.31.1, 10.22-150000.4.42.1, 10.22-150100.8.50.1
libecpg6 - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.5-3.14.9, 14.5-150200.5.17.1
libpq5-32bit - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.5-3.14.9, 14.5-150200.5.17.1
libpq5-32bit-debuginfo - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.5-150200.5.17.1
libpq5-debuginfo - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.5-3.14.9, 14.5-150200.5.17.1
libpq5 - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.5-3.14.9, 14.5-150200.5.17.1
libecpg6-debuginfo - addressed in versions 10.22-150000.4.42.1, 12.12-150100.3.33.1, 14.5-3.14.9, 14.5-150200.5.17.1
postgresql10-llvmjit-devel - update to 10.22-150100.8.50.1
postgresql10-test - update to 10.22-150100.8.50.1
rh-postgresql10-postgresql (Red Hat package) - update to 10.23-1.el7
postgresql-devel - addressed in versions 12.0.1-150000.8.19.1, 14-4.17.2
postgresql-server-devel - addressed in versions 12.0.1-150000.8.19.1, 14-4.17.2
postgresql - addressed in versions 12.0.1-150000.8.19.1, 14-4.17.2
postgresql-server - addressed in versions 12.0.1-150000.8.19.1, 14-4.17.2
postgresql-pltcl - addressed in versions 12.0.1-150000.8.19.1, 14-4.17.2
postgresql-plpython - addressed in versions 12.0.1-150000.8.19.1, 14-4.17.2
postgresql-contrib - addressed in versions 12.0.1-150000.8.19.1, 14-4.17.2
postgresql-plperl - addressed in versions 12.0.1-150000.8.19.1, 14-4.17.2
postgresql-docs - addressed in versions 12.0.1-150000.8.19.1, 14-4.17.2
postgresql-12 (Ubuntu package) - update to 12.12-0ubuntu0.20.04.1
postgresql-test-rpm-macros - addressed in versions 12.12-1.0.1, 13.10-1.0.1
postgresql - addressed in versions 12.12-1.0.1, 13.10-1.0.1
postgresql-contrib - addressed in versions 12.12-1.0.1, 13.10-1.0.1
postgresql-docs - addressed in versions 12.12-1.0.1, 13.10-1.0.1
postgresql-plperl - addressed in versions 12.12-1.0.1, 13.10-1.0.1
postgresql-plpython3 - addressed in versions 12.12-1.0.1, 13.10-1.0.1
postgresql-pltcl - addressed in versions 12.12-1.0.1, 13.10-1.0.1
postgresql-server-devel - addressed in versions 12.12-1.0.1, 13.10-1.0.1
postgresql-static - addressed in versions 12.12-1.0.1, 13.10-1.0.1
postgresql-test - addressed in versions 12.12-1.0.1, 13.10-1.0.1
postgresql-upgrade - addressed in versions 12.12-1.0.1, 13.10-1.0.1
postgresql-upgrade-devel - addressed in versions 12.12-1.0.1, 13.10-1.0.1
postgresql-server - addressed in versions 12.12-1.0.1, 13.10-1.0.1
postgresql12-plpython - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-plperl-debuginfo - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-plperl - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-debuginfo - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-contrib-debuginfo - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-contrib - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12 - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-server-devel-debuginfo - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-server-devel - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-devel-debuginfo - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-devel - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-debugsource - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-plpython-debuginfo - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-pltcl - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-pltcl-debuginfo - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-server - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-server-debuginfo - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-docs - addressed in versions 12.12-3.30.2, 12.12-150100.3.33.1, 12.12-150200.8.35.1
postgresql12-test - update to 12.12-150200.8.35.1
postgresql12-llvmjit - update to 12.12-150200.8.35.1
postgresql12-llvmjit-debuginfo - update to 12.12-150200.8.35.1
postgresql12-llvmjit-devel - update to 12.12-150200.8.35.1
postgresql13-plpython-debuginfo - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-pltcl - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-pltcl-debuginfo - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-server - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-server-debuginfo - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-docs - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-debugsource - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-plperl-debuginfo - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-plpython - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-devel - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-devel-debuginfo - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-server-devel - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-server-devel-debuginfo - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13 - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-contrib - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-contrib-debuginfo - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-debuginfo - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-plperl - addressed in versions 13.8-3.24.1, 13.8-150200.5.31.1
postgresql13-llvmjit-devel - update to 13.8-150200.5.31.1
postgresql13-llvmjit-debuginfo - update to 13.8-150200.5.31.1
postgresql13-llvmjit - update to 13.8-150200.5.31.1
postgresql13-test - update to 13.8-150200.5.31.1
postgresql (Red Hat package) - addressed in versions 13.10-1.el9_1, 13.13-1.el9_0
postgresql-14 (Ubuntu package) - update to 14.5-0ubuntu0.22.04.1
postgresql14-debugsource - addressed in versions 14.5-3.14.7, 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-devel - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-plperl-debuginfo - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-plperl - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-debuginfo - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-contrib-debuginfo - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-contrib - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14 - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-server-devel-debuginfo - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-server-devel - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-devel-debuginfo - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-server-debuginfo - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
libpq5-debuginfo-32bit - update to 14.5-3.14.9
postgresql14-server - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-docs - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-pltcl-debuginfo - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-pltcl - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-plpython-debuginfo - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-plpython - addressed in versions 14.5-3.14.9, 14.5-150200.5.17.1
postgresql14-test - update to 14.5-150200.5.17.1
libecpg6-32bit - update to 14.5-150200.5.17.1
libecpg6-32bit-debuginfo - update to 14.5-150200.5.17.1
postgresql14-llvmjit-debuginfo - update to 14.5-150200.5.17.1
postgresql14-llvmjit - update to 14.5-150200.5.17.1
postgresql14-llvmjit-devel - update to 14.5-150200.5.17.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.33, 23.0.2.5

• https://www.postgresql.org/about/news/postgresql-145-138-1212-1117-1022-and-15-beta-3-released-2496/

• Security restrictions bypass in PostgreSQL
• Ubuntu update for postgresql-10
• SUSE update for postgresql10
• SUSE update for postgresql13
• SUSE update for postgresql10
• SUSE update for postgresql10
• SUSE update for postgresql12
• SUSE update for postgresql13
• SUSE update for postgresql12
• SUSE update for postgresql14
• SUSE update for postgresql12
• SUSE update for postgresql14
• SUSE update for postgresql14
• Red Hat Enterprise Linux 8 update for the postgresql:12 module
• Multiple vulnerabilities in Dell VxRail
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Gentoo update for PostgreSQL
• IBM Sterling Connect:Direct Web Services update for PostgreSQL
• Multiple vulnerabilities in IBM Data Risk Manager
• Multiple vulnerabilities in IBM Spectrum Copy Data Management
• Multiple vulnerabilities in Dell VxRail Appliance components
• Red Hat Enterprise Linux 8 update for the postgresql:10 module
• Red Hat Software Collections update for rh-postgresql10-postgresql
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Red Hat Enterprise Linux 8 update for the postgresql:13 module
• Red Hat Enterprise Linux 9 update for postgresql
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Dell PowerStore Family
• Red Hat Enterprise Linux 9.0 Extended Update Support update for postgresql
• Red Hat Enterprise Linux 8.6 Extended Update Support update for the postgresql:13 module
• Red Hat Enterprise Linux 8 update for the postgresql:12 module
• Red Hat Enterprise Linux 8 update for the postgresql:12 module
• Red Hat Enterprise Linux 8 update for the postgresql:13 module
• Multiple vulnerabilities in IBM Storage Scale System
• Multiple vulnerabilities in IBM Security Verify Access
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Anolis OS update for postgresql:12 module
• Anolis OS update for postgresql:13 module
• Multiple vulnerabilities in IBM Network Threat Analytics