Most recent entries from all

ALSA-2020:5620 — Important: postgresql:12 security update

Affected: AlmaLinux:8: postgres-decoderbufs

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (12.5).

Security Fix(es):

* postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

* postgresql: Multiple features escape "security restricted operation" sandbox (CVE-2020-25695)

* postgresql: Uncontrolled search path element in logical replication (CVE-2020-14349)

* postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

* postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

* postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-00079

Withdrawn: BELL-CVE-2020-14350 — CVE-2020-14350 does not affect BellSoft software

Withdrawn by the publisher.

BIT-postgresql-2020-14350

Affected: Bitnami: postgresql

It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.

certfr-2020-avi-510 — De multiples vulnérabilités ont été découvertes dans PostgreSQL. Elles permettent à un attaquant de provoquer une exécu…

certfr-2020-avi-510

Withdrawn: CLEANSTART-2026-FR04784 — Security fixes in postgresql 12.4-r0

Withdrawn by the publisher.

Affected: CleanStart: postgresql

Package postgresql version 12.4-r0 fixes 2 vulnerabilities: CVE-2020-14349, CVE-2020-14350

EUVD-2026-42367

fkie_cve-2020-14350

GHSA-6v9v-3f4c-cjgx — Untrusted Search Path in PostgreSQL

gsd-2020-14350

msrc_CVE-2020-14350 — It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker w…

msrc_CVE-2020-14350

openSUSE-SU-2020:1227-1 — Security update for postgresql96, postgresql10 and postgresql12

Security update for postgresql96, postgresql10 and postgresql12

RHSA-2020:4295 — Red Hat Security Advisory: rh-postgresql96-postgresql security update

postgresql: Selectivity estimators bypass row security policies postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks postgresql: Uncontrolled search path element in CREATE EXTENSION

SUSE-SU-2020:2264-1 — Security update for postgresql10

Security update for postgresql10

UBUNTU-CVE-2020-14350

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:16.04:LTS: postgresql-9.5, Ubuntu:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12