- Vulnerability/
- USN-4472-1
USN-4472-1: PostgreSQL vulnerabilities
First published: Tue Aug 25 2020(Updated: )
Noah Misch discovered that PostgreSQL incorrectly handled the search_path setting when used with logical replication. A remote attacker could possibly use this issue to execute arbitrary SQL code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14349) Andres Freund discovered that PostgreSQL incorrectly handled search path elements in CREATE EXTENSION. A remote attacker could possibly use this issue to execute arbitrary SQL code. (CVE-2020-14350)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/postgresql-12 | <12.4-0ubuntu0.20.04.1 | 12.4-0ubuntu0.20.04.1 |
| =20.04 | ||
| All of | ||
| ubuntu/postgresql-10 | <10.14-0ubuntu0.18.04.1 | 10.14-0ubuntu0.18.04.1 |
| =18.04 | ||
| All of | ||
| ubuntu/postgresql-9.5 | <9.5.23-0ubuntu0.16.04.1 | 9.5.23-0ubuntu0.16.04.1 |
| =16.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2020-14349
- https://ubuntu.com/security/CVE-2020-14350
- https://launchpad.net/ubuntu/+source/postgresql-12/12.4-0ubuntu0.20.04.1
- https://launchpad.net/ubuntu/+source/postgresql-10/10.14-0ubuntu0.18.04.1
- https://launchpad.net/ubuntu/+source/postgresql-9.5/9.5.23-0ubuntu0.16.04.1
- https://ubuntu.com/security/notices/USN-4472-1 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this advisory?
USN-4472-1
What is the title of this advisory?
USN-4472-1: PostgreSQL vulnerabilities
What is the impact of this vulnerability?
A remote attacker could possibly use this issue to execute arbitrary SQL code.
Which versions of Ubuntu are affected by this vulnerability?
This vulnerability affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
How can I fix this vulnerability?
Upgrade to PostgreSQL 12.4-0ubuntu0.20.04.1 for Ubuntu 20.04 LTS, 10.14-0ubuntu0.18.04.1 for Ubuntu 18.04 LTS, or 9.5.23-0ubuntu0.16.04.1 for Ubuntu 16.04 LTS.
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/20.04
- version/ubuntu ubuntu/18.04
- version/ubuntu ubuntu/16.04