Description
PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3) SET ROLE and (4) SET SESSION AUTHORIZATION within index functions, which allows remote authenticated users to gain privileges.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | postgresql-7.4 | 7.4.19-0etch1 | DSA-1463-1 |
| Debian 4.0 | postgresql-8.1 | 8.1.11-0etch1 | DSA-1460-1 |
| Debian 3.1 | postgresql | 7.4.7-6sarge6 | DSA-1463-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | postgresql +9 | 8.1.11-1.el5_1.1 | RHSA-2008:0038 |
| RHEL 4 | postgresql +10 | 7.4.19-1.el4_6.1 | RHSA-2008:0038 |
| RHEL 3 | rh-postgresql +10 | 7.3.21-1 | RHSA-2008:0039 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | postgresql +9 | 8.1.11-1.el4s1.1 | RHSA-2008:0040 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | postgresql93 | 9.3.15-1.1 | openSUSE-SU-2024:10256-1 |
| openSUSE Tumbleweed | postgresql94 | 9.4.10-1.1 | openSUSE-SU-2024:10030-1 |
| openSUSE Tumbleweed | postgresql95 | 9.5.4-1.2 | openSUSE-SU-2024:10273-1 |
Advisories 8
- RHSA-2008:0040 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2008:0038 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2008:0039 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1460-1 postgresql-8.1 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1463-1 postgresql-7.4 - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10030-1 postgresql94-9.4.10-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10273-1 libecpg6-32bit-9.5.4-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10256-1 postgresql93-9.3.15-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- MDVSA-2008:004 vendor-advisory
- DSA-1460 vendor-advisory
- 28445 third-party-advisory
- oval:org.mitre.oval:def:10493 vdb-entry signature
- 27163 vdb-entry
- https://issues.rpath.com/browse/RPL-1768
- RHSA-2008:0038 vendor-advisory
- 28454 third-party-advisory
- 20080107 PostgreSQL 2007-01-07 Cumulative Security Release mailing-list
- 28359 third-party-advisory
- http://www.postgresql.org/about/news.905
- SUSE-SA:2008:005 vendor-advisory
- ADV-2008-0061 vdb-entry
- 28679 third-party-advisory
- ADV-2008-0109 vdb-entry
- 28376 third-party-advisory
- 103197 vendor-advisory
- 28437 third-party-advisory
- 28455 third-party-advisory
- 28477 third-party-advisory
- 29638 third-party-advisory
- 28479 third-party-advisory
- DSA-1463 vendor-advisory
- RHSA-2008:0040 vendor-advisory
- 20080115 rPSA-2008-0016-1 postgresql postgresql-server mailing-list
- 28464 third-party-advisory
- 28698 third-party-advisory
- SSRT080006 vendor-advisory
- 200559 vendor-advisory
- USN-568-1 vendor-advisory
- FEDORA-2008-0552 vendor-advisory
- postgresql-indexfunctions-priv-escalation(39496) vdb-entry
- 28438 third-party-advisory
- 1019157 vdb-entry
- FEDORA-2008-0478 vendor-advisory
- RHSA-2008:0039 vendor-advisory
- GLSA-200801-15 vendor-advisory
- ADV-2008-1071 vdb-entry