CVE-2020-14349: SQL Injection
A flaw was found in PostgreSQL, where it did not properly sanitize the searchpath during logical replication. This flaw allows an authenticated attacker to use this flaw in an attack similar to CVE-2018-1058 to execute an arbitrary SQL command in the user's context for replication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Other sources
It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the searchpath during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.
The PostgreSQL searchpath setting determines schemas searched for tables, functions, operators, etc. The CVE-2018-1058 fix caused most PostgreSQL-provided client applications to sanitize searchpath, but logical replication continued to leave searchpath unchanged. Users of a replication publisher or subscriber database can create objects in the "public" schema and harness them to execute arbitrary SQL functions under the identity running replication, often a superuser. Installations having adopted a documented "secure schema usage pattern" are not vulnerable.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-postgresql10-postgresqlto a version that resolves this vulnerability.Fixed in 0:10.14-1.el7 - Upgrade
Upgrade
redhat/rh-postgresql12-postgresqlto a version that resolves this vulnerability.Fixed in 0:12.4-1.el7 - Upgrade
Upgrade
redhat/rhvm-applianceto a version that resolves this vulnerability.Fixed in 0:4.4-20210310.0.el8e - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 12.4 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 11.9 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 10.14 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 12.4 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 11.9 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 10.14
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-14349?
CVE-2020-14349 is a vulnerability that affects PostgreSQL versions before 12.4, before 11.9, and before 10.14. It allows an authenticated attacker to execute arbitrary SQL commands in the user's context for replication.
How does CVE-2020-14349 impact PostgreSQL?
CVE-2020-14349 impacts PostgreSQL by not properly sanitizing the search_path during logical replication, which allows an attacker to execute arbitrary SQL commands in the user's context for replication.
What is the severity of CVE-2020-14349?
CVE-2020-14349 has a severity value of 7 (high).
Which versions of PostgreSQL are affected by CVE-2020-14349?
CVE-2020-14349 affects versions before 12.4, before 11.9, and before 10.14 of PostgreSQL.
How can I fix the CVE-2020-14349 vulnerability?
To fix the CVE-2020-14349 vulnerability, you should update PostgreSQL to version 12.4, version 11.9, or version 10.14.