Summary
Noah Misch discovered that PostgreSQL incorrectly handled the search_path
setting when used with logical replication. A remote attacker could
possibly use this issue to execute arbitrary SQL code. This issue only
affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14349)
Andres Freund discovered that PostgreSQL incorrectly handled search path
elements in CREATE EXTENSION. A remote attacker could possibly use this
issue to execute arbitrary SQL code. (CVE-2020-14350)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | postgresql-9.5 | 9.5.23-0ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | postgresql-10 | 10.14-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | postgresql-12 | 12.4-0ubuntu0.20.04.1 |
Vulnerabilities 2
-
Unscored —
It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_pa…
-
Unscored —
It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker w…