Remote Code Execution (RCE)

2020-09-0702:40:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0004 Low

EPSS

Percentile

14.3%

JSON

PostgreSQL is vulnerable to remote code execution (RCE). It did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension.

CPENameOperatorVersion
postgresql:3.11eq12.2-r0
postgresql:3.11eq12.1-r0
postgresql:3.12eq12.3-r2
postgresql:3.9eq11.7-r0
postgresql:3.10eq11.7-r0
postgresql-10:bioniceq10.3-1
postgresql-12:focaleq12.2-4
postgresql-12:develeq12.3
postgresql-9.5:xenialeq9.5.2-1
rh-postgresql96-postgresqleq9.6.10__1.el7

Name	Operator	Version
postgresql:3.11	eq	12.2-r0
postgresql:3.11	eq	12.1-r0
postgresql:3.12	eq	12.3-r2
postgresql:3.9	eq	11.7-r0
postgresql:3.10	eq	11.7-r0
postgresql-10:bionic	eq	10.3-1
postgresql-12:focal	eq	12.2-4
postgresql-12:devel	eq	12.3
postgresql-9.5:xenial	eq	9.5.2-1
rh-postgresql96-postgresql	eq	9.6.10__1.el7