VuXML ID | Description |
76e0bb86-b4cb-11eb-b9c9-6cc21735f730 | PostgreSQL -- Memory disclosure in partitioned-table UPDATE ... RETURNING
The PostgreSQL project reports:
Using an UPDATE ... RETURNING on a purpose-crafted partitioned
table, an attacker can read arbitrary bytes of server memory. In the
default configuration, any authenticated database user can create
prerequisite objects and complete this attack at will. A user
lacking the CREATE and TEMPORARY privileges on all databases and the
CREATE privilege on all schemas typically cannot use this attack at
will.
Discovery 2021-05-13 Entry 2021-05-14 postgresql13-server
< 13.3
postgresql12-server
< 12.7
postgresql11-server
< 11.12
https://www.postgresql.org/support/security/CVE-2021-32029/
|
2ccd71bd-426b-11ec-87db-6cc21735f730 | PostgreSQL -- Possible man-in-the-middle attacks
The PostgreSQL Project reports:
CVE-2021-23214: A man-in-the-middle with the ability to inject data into the TCP connection could stuff some cleartext data into the start of a supposedly encryption-protected database session. This could be abused to send faked SQL commands to the server, although that would only work if the server did not demand any authentication data. (However, a server relying on SSL certificate authentication might well not do so.)
CVE-2021-23222: A man-in-the-middle with the ability to inject data into the TCP connection could stuff some cleartext data into the start of a supposedly encryption-protected database session. This could probably be abused to inject faked responses to the client's first few queries, although other details of libpq's behavior make that harder than it sounds. A different line of attack is to exfiltrate the client's password, or other sensitive data that might be sent early in the session. That has been shown to be possible with a server vulnerable to CVE-2021-23214.
Discovery 2021-11-08 Entry 2021-11-10 postgresql14-server
< 14.1
postgresql13-server
< 13.5
postgresql12-server
< 12.9
postgresql11-server
< 11.14
postgresql10-server
< 10.19
postgresql96-server
< 9.6.24
CVE-2021-23214
CVE-2021-23222
|
b471130b-fb86-11eb-87db-6cc21735f730 | PostgreSQL server -- Memory disclosure in certain queries
The PostgreSQL Project reports:
A purpose-crafted query can read arbitrary bytes of
server memory. In the default configuration, any
authenticated database user can complete this attack at
will. The attack does not require the ability to create
objects. If server settings include
max_worker_processes=0, the known versions of this
attack are infeasible. However, undiscovered variants of
the attack may be independent of that setting.
Discovery 2021-08-12 Entry 2021-08-12 postgresql13-server
< 13.4
postgresql12-server
< 12.8
postgresql11-server
< 11.13
CVE-2021-3677
https://www.postgresql.org/support/security/CVE-2021-3677/
|
9de4c1c1-b9ee-11e9-82aa-6cc21735f730 | PostgresSQL -- TYPE in pg_temp execute arbitrary SQL during `SECURITY DEFINER` execution
The PostgreSQL project reports:
Versions Affected: 9.4 - 11
Given a suitable `SECURITY DEFINER` function, an attacker can execute arbitrary
SQL under the identity of the function owner. An attack requires `EXECUTE`
permission on the function, which must itself contain a function call having
inexact argument type match. For example, `length('foo'::varchar)` and
`length('foo')` are inexact, while `length('foo'::text)` is exact.
As part of exploiting this vulnerability, the attacker uses `CREATE DOMAIN`
to create a type in a `pg_temp` schema. The attack pattern and fix are similar
to that for CVE-2007-2138.
Writing `SECURITY DEFINER` functions continues to require following
the considerations noted in the documentation:
https://www.postgresql.org/docs/devel/sql-createfunction.html#SQL-CREATEFUNCTION-SECURITY
Versions Affected: 11
In a database containing hypothetical, user-defined hash equality operators,
an attacker could read arbitrary bytes of server memory. For an attack to
become possible, a superuser would need to create unusual operators.
It is possible for operators not purpose-crafted for attack to have
the properties that enable an attack, but we are not aware of specific examples.
Discovery 2019-08-08 Entry 2019-08-08 postgresql11-server
< 11.5
postgresql10-server
< 10.10
postgresql96-server
< 9.6.15
postgresql95-server
< 9.5.19
postgresql94-server
< 9.4.24
https://www.postgresql.org/about/news/1960/
CVE-2019-10208
CVE-2019-10209
|
e66a5440-7258-11e9-b0e1-6cc21735f730 | PostgreSQL -- Memory disclosure in partition routing
The PostgreSQL project reports:
Prior to this release, a user running PostgreSQL 11 can read
arbitrary bytes of server memory by executing a purpose-crafted
INSERT statement to a partitioned table.
Discovery 2019-05-09 Entry 2019-05-09 postgresql11-server
< 11.3
https://www.postgresql.org/about/news/1939/
CVE-2019-10129
|
157ce083-d145-11ec-ab9b-6cc21735f730 | PostgreSQL Server -- execute arbitrary SQL code as DBA user
The PostgreSQL project reports:
Confine additional operations within "security restricted
operation" sandboxes.
Autovacuum, CLUSTER, CREATE INDEX, REINDEX, REFRESH MATERIALIZED VIEW,
and pg_amcheck activated the "security restricted operation" protection
mechanism too late, or even not at all in some code paths.
A user having permission to create non-temporary objects within a
database could define an object that would execute arbitrary SQL
code with superuser permissions the next time that autovacuum
processed the object, or that some superuser ran one of the affected
commands against it.
Discovery 2022-05-11 Entry 2022-05-11 postgresql14-server
< 14.3
postgresql13-server
< 13.7
postgresql12-server
< 12.11
postgresql11-server
< 11.16
postgresql10-server
< 10.21
CVE-2022-1552
|
62da9702-b4cc-11eb-b9c9-6cc21735f730 | PostgreSQL server -- two security issues
The PostgreSQL project reports:
Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE
Using an INSERT ... ON CONFLICT ... DO UPDATE command on a
purpose-crafted table, an attacker can read arbitrary bytes of
server memory. In the default configuration, any authenticated
database user can create prerequisite objects and complete this
attack at will. A user lacking the CREATE and TEMPORARY privileges
on all databases and the CREATE privilege on all schemas cannot use
this attack at will..
Buffer overrun from integer overflow in array subscripting
calculations
While modifying certain SQL array values, missing bounds checks let
authenticated database users write arbitrary bytes to a wide area of
server memory.
Discovery 2021-05-13 Entry 2021-05-14 postgresql13-server
< 13.3
postgresql12-server
< 12.7
postgresql11-server
< 11.12
postgresql10-server
< 10.17
postgresql96-server
< 9.6.22
https://www.postgresql.org/support/security/CVE-2021-32027/
https://www.postgresql.org/support/security/CVE-2021-32028/
|
245629d4-991e-11e9-82aa-6cc21735f730 | PostgreSQL -- Stack-based buffer overflow via setting a password
The PostgreSQL project reports:
An authenticated user could create a stack-based buffer overflow
by changing their own password to a purpose-crafted value. In addition
to the ability to crash the PostgreSQL server, this could be further
exploited to execute arbitrary code as the PostgreSQL operating system account.
Additionally, a rogue server could send a specifically crafted
message during the SCRAM authentication process and cause a libpq-enabled client
to either crash or execute arbitrary code as the client's operating system account.
This issue is fixed by upgrading and restarting your PostgreSQL
server as well as your libpq installations. All users running
PostgreSQL 10, 11, and 12 beta are encouraged to upgrade as soon as possible.
Discovery 2019-06-20 Entry 2019-06-27 postgresql11-server
< 11.4
postgresql10-server
< 10.9
https://www.postgresql.org/about/news/1949/
CVE-2019-10164
|
d331f691-71f4-11ea-8bb5-6cc21735f730 | PostgresSQL -- ALTER ... DEPENDS ON EXTENSION is missing authorization checks
The PostgreSQL project reports:
Versions Affected: 9.6 - 12
The ALTER ... DEPENDS ON EXTENSION sub-commands do not perform
authorization checks, which can allow an unprivileged user to drop
any function, procedure, materialized view, index, or trigger under
certain conditions. This attack is possible if an administrator has
installed an extension and an unprivileged user can CREATE, or an
extension owner either executes DROP EXTENSION predictably or can be
convinced to execute DROP EXTENSION.
Discovery 2020-02-13 Entry 2020-03-29 postgresql12-server
< 12.2
postgresql11-server
< 11.7
postgresql10-server
< 10.12
postgresql96-server
< 9.6.17
https://www.postgresql.org/about/news/1960/
CVE-2020-1720
|
065890c3-725e-11e9-b0e1-6cc21735f730 | PostgreSQL -- Selectivity estimators bypass row security policies
The PostgreSQL project reports:
PostgreSQL maintains statistics for tables by sampling
data available in columns; this data is consulted during
the query planning process. Prior to this release, a user
able to execute SQL queries with permissions to read a
given column could craft a leaky operator that could
read whatever data had been sampled from that column.
If this happened to include values from rows that the user
is forbidden to see by a row security policy, the user
could effectively bypass the policy. This is fixed by only
allowing a non-leakproof operator to use this data if
there are no relevant row security policies for the table.
Discovery 2019-05-09 Entry 2019-05-09 postgresql11-server
< 11.3
postgresql10-server
< 10.8
postgresql96-server
< 9.6.13
postgresql95-server
< 9.5.17
https://www.postgresql.org/about/news/1939/
CVE-2019-10130
|