Non notée
CVE-2020-14350 It was found that some PostgreSQL extensions did not use search_path safely in their installation script
Description
It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| postgresql | Versions non publiées |
Références
- openSUSE-SU-2020:1227 lists.opensuse.org
- openSUSE-SU-2020:1228 lists.opensuse.org
- openSUSE-SU-2020:1244 lists.opensuse.org
- openSUSE-SU-2020:1243 lists.opensuse.org
- bugzilla.redhat.com bugzilla.redhat.com
- [debian-lts-announce] 20200817 [SECURITY] [DLA 2331-1] posgresql-9.6 security update lists.debian.org
- GLSA-202008-13 security.gentoo.org
- USN-4472-1 usn.ubuntu.com
- openSUSE-SU-2020:1312 lists.opensuse.org
- openSUSE-SU-2020:1326 lists.opensuse.org
- security.netapp.com security.netapp.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de postgresql
Les 79 CVE de postgresql →
CVE-2026-6471
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen…
7.2
Élevée
CVE-2026-14671
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating…
8.8
Élevée
CVE-2026-6470
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and…
4.3
Moyenne
CVE-2026-6464
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as…
8.1
Élevée