p PatchFirst

CVE-2020-14349

CVE-2020-14349

This page contains facts from public vulnerability sources. Check the original advisory before updating.

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.

CVSS 7.1 · High · EPSS 2.2% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • postgresql

    Versions
    • PostgreSQL versions before 12.4, before 11.9 and before 10.14: Affected

    No fix published

  • postgresql-10 Ubuntu:18.04:LTS

    Versions
    • 10.1-1
    • 10.1-2
    • 10.2-1
    • 10.3-1
    • 10.4-0ubuntu0.18.04
    • 10.5-0ubuntu0.18.04
    • 10.6-0ubuntu0.18.04.1
    • 10.7-0ubuntu0.18.04.1
    • 10.8-0ubuntu0.18.04.1
    • 10.9-0ubuntu0.18.04.1
    • 10.10-0ubuntu0.18.04.1
    • 10.12-0ubuntu0.18.04.1
    Affected ranges
    • ECOSYSTEM: < 10.14-0ubuntu0.18.04.1

    Update to 10.14-0ubuntu0.18.04.1

  • postgresql-12 Ubuntu:20.04:LTS

    Versions
    • 12.0-1
    • 12.1-1
    • 12.1-2build1
    • 12.2-1
    • 12.2-1ubuntu2
    • 12.2-4
    Affected ranges
    • ECOSYSTEM: < 12.4-0ubuntu0.20.04.1

    Update to 12.4-0ubuntu0.20.04.1

Original sources

Check your server →