SB2020082527 - Ubuntu update for postgresql-10 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020082527

SB2020082527 - Ubuntu update for postgresql-10

Published: August 25, 2020 Updated: April 23, 2025

Security Bulletin ID SB2020082527
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Untrusted search path (CVE-ID: CVE-2020-14349)

The vulnerability allows a remote user to escalate privileges within the database.

The vulnerability exists due to the way PostgreSQL handles search_path during replications. Users of a replication publisher or subscriber database can create objects in the public schema and harness them to execute arbitrary SQL functions under the identity running replication, often a superuser.


2) Untrusted search path (CVE-ID: CVE-2020-14350)

The vulnerability allows a remote user to escalate privileges within the database.

The vulnerability exists due to the way PostgreSQL handles CREATE EXTENSION statements. A remote user with permission to create objects in the new extension's schema or a schema of a prerequisite extension can execute arbitrary SQL functions under the identity of the superuser in certain cases.


Remediation

Install update from vendor's website.

References