Уязвимость CVE-2022-2625: Информация

Описание

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

Важность: HIGH (8,0) Вектор: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Исправленные пакеты

Ссылки на рекомендации, решения и инструменты

1. Подверженные конфигурации:

   1. Конфигурация 1

      cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

      Start including

      10.0

      End excliding

      10.22

      ---

      cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

      Start including

      11.0

      End excliding

      11.17

      ---

      cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

      Start including

      12.0

      End excliding

      12.12

      ---

      cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

      Start including

      13.0

      End excliding

      13.8

      ---

      cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

      Start including

      14.0

      End excliding

      14.5

      ---

      cpe:2.3:a:postgresql:postgresql:15:beta2:*:*:*:*:*:*

      ---

      cpe:2.3:a:postgresql:postgresql:15:beta1:*:*:*:*:*:*

      ---

      Конфигурация 2

      cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

      ---

      Конфигурация 3

      cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

      ---