SB2020082703 - Gentoo update for PostgreSQL

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Untrusted search path (CVE-ID: CVE-2020-14349)

The vulnerability allows a remote user to escalate privileges within the database.

The vulnerability exists due to the way PostgreSQL handles search_path during replications. Users of a replication publisher or subscriber database can create objects in the public schema and harness them to execute arbitrary SQL functions under the identity running replication, often a superuser.

2) Untrusted search path (CVE-ID: CVE-2020-14350)

The vulnerability allows a remote user to escalate privileges within the database.

The vulnerability exists due to the way PostgreSQL handles CREATE EXTENSION statements. A remote user with permission to create objects in the new extension's schema or a schema of a prerequisite extension can execute arbitrary SQL functions under the identity of the superuser in certain cases.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/
• https://security.gentoo.org/glsa/202008-13