GHSA-fv9p-9rr9-fm35: Babelfish for PostgreSQL Privilege Escalation
Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Babelfish for PostgreSQL extensionto a version that resolves this vulnerability.Fixed in 4.10 - Upgrade
Upgrade
Babelfish for PostgreSQL extensionto a version that resolves this vulnerability.Fixed in 5.6 - Upgrade
Upgrade
Babelfish for PostgreSQL extensionto a version that resolves this vulnerability.Fixed in 6.1
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using the Babelfish for PostgreSQL extension in versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, or 5.1-5.4 are affected.
What access does an attacker need?
An attacker must be able to authenticate remotely. The vulnerability does not require user interaction and has low attack complexity, but it does require low-level privileges.
What is the recommended remediation?
Upgrade the Babelfish for PostgreSQL extension to version 4.10, 5.6, 6.1, or a later version.