Vulnerability CVE-2020-1720: Information

Description

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.

Severity: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2020-1720
Published: March 17, 2020
Modified: Nov. 7, 2023
Error type identifier: CWE-862

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
postgresql10p1010.12-alt110.23-alt1.p10.1ALT-PU-2020-1179-1245892Fixed
postgresql10p910.12-alt110.23-alt0.M90P.1ALT-PU-2020-1259-1245909Fixed
postgresql10p810.12-alt0.M80P.110.19-alt0.M80P.1ALT-PU-2020-1333-1245913Fixed
postgresql10c10f110.12-alt110.23-alt1ALT-PU-2020-1179-1245892Fixed
postgresql10c9f210.12-alt110.23-alt0.M90P.1ALT-PU-2020-1259-1245909Fixed
postgresql11p1011.7-alt111.22-alt0.p10.1ALT-PU-2020-1180-1245892Fixed
postgresql11p911.7-alt111.22-alt0.M90P.1ALT-PU-2020-1260-1245909Fixed
postgresql11p811.7-alt0.M80P.111.14-alt0.M80P.1ALT-PU-2020-1332-1245913Fixed
postgresql11c10f111.7-alt111.22-alt0.p10.1ALT-PU-2020-1180-1245892Fixed
postgresql11c9f211.7-alt111.22-alt0.M90P.1ALT-PU-2020-1260-1245909Fixed
postgresql11-1Cp811.5-alt0.M80P.411.12-alt0.M80P.2ALT-PU-2020-1334-1245913Fixed
postgresql12sisyphus12.2-alt112.18-alt1ALT-PU-2020-1177-1245892Fixed
postgresql12p1012.2-alt112.18-alt0.p10.1ALT-PU-2020-1177-1245892Fixed
postgresql12p912.2-alt112.18-alt0.M90P.1ALT-PU-2020-1257-1245909Fixed
postgresql12p812.2-alt0.M80P.112.9-alt0.M80P.1ALT-PU-2020-1335-1245913Fixed
postgresql12c10f112.2-alt112.18-alt0.p10.1ALT-PU-2020-1177-1245892Fixed
postgresql12c9f212.2-alt112.18-alt0.c9f2.1ALT-PU-2020-1257-1245909Fixed
postgresql9.6p99.6.17-alt19.6.24-alt0.M90P.1ALT-PU-2020-1258-1245909Fixed
postgresql9.6p89.6.17-alt0.M80P.19.6.24-alt0.M80P.1ALT-PU-2020-1336-1245913Fixed
postgresql9.6c9f29.6.17-alt19.6.24-alt0.M90P.1ALT-PU-2020-1258-1245909Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1720
  • Issue Tracking
  • Patch
  • Third Party Advisory
https://www.postgresql.org/about/news/2011/
  • Release Notes
  • Vendor Advisory
openSUSE-SU-2020:1227

      1. Configuration 1

        cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
        Start including
        12.0
        End excliding
        12.2
        cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
        Start including
        11.0
        End excliding
        11.7
        cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
        Start including
        10.0
        End excliding
        10.12
        cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
        Start including
        9.6
        End excliding
        9.6.17

        Configuration 2

        cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
        cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*
    VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
    Version: v24.4.2
    Back to top