CVE-2022-1552: SQL Injection
A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity.
Other sources
Vulnerability details:
Autovacuum, REINDEX, and others omit "security restricted operation" sandbox.
CVSS v3 Base Score: 8.8 [https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H]
Supported, Vulnerable Versions: 10 - 14. The security team typically does not test unsupported versions, but this problem is quite old.
Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck made incomplete efforts to operate safely when a privileged user is maintaining another user's objects. Those commands activated relevant protections too late or not at all. An attacker having permission to create non-temp objects in at least one schema could execute arbitrary SQL functions under a superuser identity.
While promptly updating PostgreSQL is the best remediation for most users, a user unable to do that can work around the vulnerability by disabling autovacuum, not manually running the above commands, and not restoring from output of the pgdump command. Performance may degrade quickly under this workaround. VACUUM is safe, and all commands are fine when a trusted user owns the target object.
The PostgreSQL project thanks Alexander Lakhin for reporting this problem.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-1552?
CVE-2022-1552 is a vulnerability found in PostgreSQL that allows a privileged user to maintain another user's objects without proper protections.
How does CVE-2022-1552 affect PostgreSQL?
CVE-2022-1552 affects PostgreSQL versions 10.0 to 10.21, 11.0 to 11.16, 12.0 to 12.11, 13.0 to 13.7, and 14.0 to 14.3.
What is the severity of CVE-2022-1552?
CVE-2022-1552 has a severity rating of 8.8 (high).
How can I fix CVE-2022-1552?
To fix CVE-2022-1552, it is recommended to update PostgreSQL to version 14.3, 13.7, 12.11, 11.16, or 10.21 depending on the installed version.
Where can I find more information about CVE-2022-1552?
More information about CVE-2022-1552 can be found at the following references: [1] [2] [3].