PostgreSQL Non-Temporary Object dynamically-managed code resources

Summaryinfo

A vulnerability described as critical has been identified in PostgreSQL. This affects an unknown part of the component Non-Temporary Object Handler. The manipulation results in an unknown weakness. This vulnerability is identified as CVE-2022-2625. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in PostgreSQL (Database Software) (unknown version). It has been classified as critical. Affected is an unknown code block of the component Non-Temporary Object Handler. CWE is classifying the issue as CWE-913. The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A vulnerability found in postgresql. On this security issue an attack requires permission to create non-temporary objects in at least one schema, ability to lure or wait for an administrator to create or update an affected extension in that schema, and ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, the attacker can run arbitrary code as the victim role, which may be a superuser. Known-affected extensions include both PostgreSQL-bundled and non-bundled extensions. PostgreSQL blocks this attack in the core server, so there's no need to modify individual extensions.

The weakness was released 08/19/2022. The advisory is shared for download at postgresql.org. This vulnerability is traded as CVE-2022-2625 since 08/02/2022. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 236748 (Alibaba Cloud Linux 3 : 0036: postgresql:13 (ALINUX3-SA-2023:0036)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at postgresql.org.

The vulnerability is also documented in the databases at Tenable (236748) and EUVD (EUVD-2022-34872). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Database Software

Name

• PostgreSQL

License

• open-source

Website

• Product: https://www.postgresql.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion