Уязвимость CVE-2020-14350: Информация

Описание

It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.

Важность: HIGH (7,3) Вектор: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Исправленные пакеты

Ссылки на рекомендации, решения и инструменты

1. Подверженные конфигурации:

   1. Конфигурация 1

      cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

      Start including

      10.0

      End excliding

      10.14

      ---

      cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

      Start including

      11.0

      End excliding

      11.9

      ---

      cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

      Start including

      12.0

      End excliding

      12.4

      ---

      cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

      Start including

      9.5

      End excliding

      9.5.23

      ---

      cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

      Start including

      9.6

      End excliding

      9.6.19

      ---

      Конфигурация 2

      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

      ---

      Конфигурация 3

      cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*

      ---

      Конфигурация 4

      cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

      ---

      cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

      ---

      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

      ---