Privilege Escalation

2020-04-1000:52:08

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.04 Low

EPSS

Percentile

92.1%

JSON

postgresql is vulnerable to privilege escalation. The vulnerability exists as it was discovered that a user could utilize the features of the PL/Perl and PL/Tcl languages to modify the behavior of a SECURITY DEFINER function created by a different user. If the PL/Perl or PL/Tcl language was used to implement a SECURITY DEFINER function, an authenticated database user could use a PL/Perl or PL/Tcl script to modify the behavior of that function during subsequent calls in the same session. This would result in the modified or injected code also being executed with the privileges of the user who created the SECURITY DEFINER function, possibly leading to privilege escalation.

CPENameOperatorVersion
postgresqleq8.1.9__1.el5
postgresqleq7.4.19__1.el4_6.1
postgresqleq7.4.26__1.el4_8.1
postgresqleq8.1.8__1.el5
postgresqleq8.1.21__1.el5_5.1
postgresqleq8.1.18__2.el5_4.1
postgresqleq8.4.4__2.el6
postgresqleq8.1.11__1.el5_1.1
postgresqleq7.4.29__1.el4_8.1
postgresql84eq8.4.2__5.el5

Name	Operator	Version
postgresql	eq	8.1.9__1.el5
postgresql	eq	7.4.19__1.el4_6.1
postgresql	eq	7.4.26__1.el4_8.1
postgresql	eq	8.1.8__1.el5
postgresql	eq	8.1.21__1.el5_5.1
postgresql	eq	8.1.18__2.el5_4.1
postgresql	eq	8.4.4__2.el6
postgresql	eq	8.1.11__1.el5_1.1
postgresql	eq	7.4.29__1.el4_8.1
postgresql84	eq	8.4.2__5.el5