Description
Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function owner, related to "search_path settings."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | postgresql-7.4 | 1:7.4.17-0etch1 | DSA-1311-1 |
| Debian 4.0 | postgresql-8.1 | 8.1.9-0etch1 | DSA-1309-1 |
| Debian 3.1 | postgresql | 7.4.7-6sarge5 | DSA-1311-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | postgresql +9 | 8.1.9-1.el5 | RHSA-2007:0336 |
| RHEL 4 | postgresql +10 | 7.4.17-1.RHEL4.1 | RHSA-2007:0336 |
| RHEL 3 | rh-postgresql +10 | 7.3.19-1 | RHSA-2007:0336 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | postgresql +9 | 8.1.9-1.el4s1.1 | RHSA-2007:0337 |
Advisories 4
- RHSA-2007:0336 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1309-1 postgresql-8.1 Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1311-1 postgresql-7.4 Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2007:0337 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 25334 third-party-advisory
- 25717 third-party-advisory
- 2007-0015 vendor-advisory
- http://www.postgresql.org/about/news.791
- 25058 third-party-advisory
- GLSA-200705-12 vendor-advisory
- MDKSA-2007:094 vendor-advisory
- https://issues.rpath.com/browse/RPL-1292
- 24999 third-party-advisory
- 25037 third-party-advisory
- 24989 third-party-advisory
- 23618 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2007-190.htm
- RHSA-2007:0337 vendor-advisory
- 25725 third-party-advisory
- http://www.postgresql.org/support/security.html
- 1017974 vdb-entry
- postgresql-searchpath-privilege-escalation(33842) vdb-entry
- 25720 third-party-advisory
- DSA-1311 vendor-advisory
- DSA-1309 vendor-advisory
- ADV-2007-1549 vdb-entry
- 25019 third-party-advisory
- USN-454-1 vendor-advisory
- 25238 third-party-advisory
- RHSA-2007:0336 vendor-advisory
- 102894 vendor-advisory
- 25184 third-party-advisory
- ADV-2007-1497 vdb-entry
- oval:org.mitre.oval:def:10090 vdb-entry signature
- 25005 third-party-advisory