p PatchFirst

CVE-2020-1720

CVE-2020-1720

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.

CVSS 3.1 · Low · EPSS 1.2% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • postgresql

    Versions
    • 12.2: Affected
    • 11.7: Affected
    • 10.12: Affected
    • 9.6.17: Affected

    No fix published

  • postgresql-10 Ubuntu:18.04:LTS

    Versions
    • 10.1-1
    • 10.1-2
    • 10.2-1
    • 10.3-1
    • 10.4-0ubuntu0.18.04
    • 10.5-0ubuntu0.18.04
    • 10.6-0ubuntu0.18.04.1
    • 10.7-0ubuntu0.18.04.1
    • 10.8-0ubuntu0.18.04.1
    • 10.9-0ubuntu0.18.04.1
    • 10.10-0ubuntu0.18.04.1
    Affected ranges
    • ECOSYSTEM: < 10.12-0ubuntu0.18.04.1

    Update to 10.12-0ubuntu0.18.04.1

Original sources

Check your server →