PostgreSQL up to 10.13/11.8/12.3 Replication uncontrolled search path

Summaryinfo

A vulnerability described as critical has been identified in PostgreSQL up to 10.13/11.8/12.3. This issue affects some unknown processing of the component Replication Handler. Executing a manipulation can lead to uncontrolled search path. This vulnerability is handled as CVE-2020-14349. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in PostgreSQL up to 10.13/11.8/12.3 (Database Software) and classified as critical. This vulnerability affects an unknown code block of the component Replication Handler. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. The CWE definition for the vulnerability is CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.

The weakness was released 08/24/2020 as Bug 1865744 as not defined bug report (Bugzilla). The advisory is available at bugzilla.redhat.com. This vulnerability was named CVE-2020-14349 since 06/17/2020. The attack can be initiated remotely. The requirement for exploitation is a single authentication. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1574 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 236609 (Alibaba Cloud Linux 3 : 0017: postgresql:12 (ALINUX3-SA-2021:0017)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 10.14, 11.9 or 12.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (236609). Entry connected to this vulnerability is available at VDB-160187. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Database Software

Name

• PostgreSQL

Version

• 10.0
• 10.1
• 10.2
• 10.3
• 10.4
• 10.5
• 10.6
• 10.7
• 10.8
• 10.9
• 10.10
• 10.11
• 10.12
• 10.13
• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.7
• 11.8
• 12.0
• 12.1
• 12.2
• 12.3

License

• open-source

Website

• Product: https://www.postgresql.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion