CVE-2014-0060: Medium severity PostgreSQL postgresql vulnerability
PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 8.4.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 9.0.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 9.1.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 9.2.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 9.3.3
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0060?
CVE-2014-0060 is considered a medium severity vulnerability as it allows authenticated users to alter role memberships.
How do I fix CVE-2014-0060?
To fix CVE-2014-0060, upgrade PostgreSQL to version 8.4.20, 9.0.16, 9.1.12, 9.2.7, or 9.3.3 or later.
Who is affected by CVE-2014-0060?
CVE-2014-0060 affects users of PostgreSQL versions before 8.4.20, 9.0.x before 9.0.16, and other specified earlier versions.
What systems are impacted by CVE-2014-0060?
Affected systems include those running PostgreSQL versions prior to those specified in the CVE-2014-0060 description.
What kind of attacks can exploit CVE-2014-0060?
CVE-2014-0060 can be exploited by remote authenticated users to gain unauthorized access to modify roles.