BIT-postgresql-2020-14350

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/postgresql/BIT-postgresql-2020-14350.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-postgresql-2020-14350
Aliases
Published
2024-03-06T11:06:40.674Z
Modified
2025-04-03T14:40:37.652Z
Summary
[none]
Details

It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.

Database specific 
{
    "severity": "High",
    "cpes": [
        "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*"
    ]
}
References

Affected packages

Bitnami / postgresql

Package

Name
postgresql
Purl
pkg:bitnami/postgresql

Severity

  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
9.5.0
Fixed
9.5.23
Introduced
9.6.0
Fixed
9.6.19
Introduced
10.0.0
Fixed
10.14.0
Introduced
11.0.0
Fixed
11.9.0
Introduced
12.0.0
Fixed
12.4.0

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/postgresql/BIT-postgresql-2020-14350.json"