openEuler 20.03 LTS update for postgresql
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2020-14349 CVE-2020-14350 CVE-2018-1058 |
| CWE-ID | CWE-426 CWE-427 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
openEuler Operating systems & Components / Operating system postgresql-test-rpm-macros Operating systems & Components / Operating system package or component postgresql-test Operating systems & Components / Operating system package or component postgresql-static Operating systems & Components / Operating system package or component postgresql-server Operating systems & Components / Operating system package or component postgresql-pltcl Operating systems & Components / Operating system package or component postgresql-plpython3 Operating systems & Components / Operating system package or component postgresql-plperl Operating systems & Components / Operating system package or component postgresql-libs Operating systems & Components / Operating system package or component postgresql-help Operating systems & Components / Operating system package or component postgresql-devel Operating systems & Components / Operating system package or component postgresql-debugsource Operating systems & Components / Operating system package or component postgresql-debuginfo Operating systems & Components / Operating system package or component postgresql-contrib Operating systems & Components / Operating system package or component postgresql Operating systems & Components / Operating system package or component |
| Vendor | openEuler |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Untrusted search path
EUVDB-ID: #VU45748
Risk: Medium
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2020-14349
CWE-ID:
CWE-426 - Untrusted Search Path
Exploit availability: No
DescriptionThe vulnerability allows a remote user to escalate privileges within the database.
The vulnerability exists due to the way PostgreSQL handles search_path during replications. Users of a
replication publisher or subscriber database can create objects in the public
schema and harness them to execute arbitrary SQL functions under the identity
running replication, often a superuser.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS
postgresql-test-rpm-macros: before 10.5-18
postgresql-test: before 10.5-18
postgresql-static: before 10.5-18
postgresql-server: before 10.5-18
postgresql-pltcl: before 10.5-18
postgresql-plpython3: before 10.5-18
postgresql-plperl: before 10.5-18
postgresql-libs: before 10.5-18
postgresql-help: before 10.5-18
postgresql-devel: before 10.5-18
postgresql-debugsource: before 10.5-18
postgresql-debuginfo: before 10.5-18
postgresql-contrib: before 10.5-18
postgresql: before 10.5-18
CPE2.3- cpe:2.3:o:openeuler:openeuler:20.03:LTS:*:*:*:*:*:*
- cpe:2.3:o:openeuler:postgresql-test-rpm-macros:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-test:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-static:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-server:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-pltcl:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-plpython3:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-plperl:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-libs:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-help:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-contrib:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2020-1067
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Untrusted search path
EUVDB-ID: #VU45749
Risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2020-14350
CWE-ID:
CWE-426 - Untrusted Search Path
Exploit availability: No
DescriptionThe vulnerability allows a remote user to escalate privileges within the database.
The vulnerability exists due to the way PostgreSQL handles CREATE EXTENSION statements. A remote user with permission to create objects in the new extension's schema
or a schema of a prerequisite extension can execute arbitrary SQL functions under the identity of the superuser in certain cases.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS
postgresql-test-rpm-macros: before 10.5-18
postgresql-test: before 10.5-18
postgresql-static: before 10.5-18
postgresql-server: before 10.5-18
postgresql-pltcl: before 10.5-18
postgresql-plpython3: before 10.5-18
postgresql-plperl: before 10.5-18
postgresql-libs: before 10.5-18
postgresql-help: before 10.5-18
postgresql-devel: before 10.5-18
postgresql-debugsource: before 10.5-18
postgresql-debuginfo: before 10.5-18
postgresql-contrib: before 10.5-18
postgresql: before 10.5-18
CPE2.3- cpe:2.3:o:openeuler:openeuler:20.03:LTS:*:*:*:*:*:*
- cpe:2.3:o:openeuler:postgresql-test-rpm-macros:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-test:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-static:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-server:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-pltcl:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-plpython3:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-plperl:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-libs:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-help:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-contrib:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2020-1067
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Privilege escalation
EUVDB-ID: #VU10810
Risk: Low
CVSSv4.0: 7.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Clear]
CVE-ID: CVE-2018-1058
CWE-ID:
CWE-427 - Uncontrolled Search Path Element
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to gain elevated privileges on the target system.
The weakness exists in the pg_dump function due to improper security restrictions. A local attacker can submit a malicious function in separate namespaces and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS
postgresql-test-rpm-macros: before 10.5-18
postgresql-test: before 10.5-18
postgresql-static: before 10.5-18
postgresql-server: before 10.5-18
postgresql-pltcl: before 10.5-18
postgresql-plpython3: before 10.5-18
postgresql-plperl: before 10.5-18
postgresql-libs: before 10.5-18
postgresql-help: before 10.5-18
postgresql-devel: before 10.5-18
postgresql-debugsource: before 10.5-18
postgresql-debuginfo: before 10.5-18
postgresql-contrib: before 10.5-18
postgresql: before 10.5-18
CPE2.3- cpe:2.3:o:openeuler:openeuler:20.03:LTS:*:*:*:*:*:*
- cpe:2.3:o:openeuler:postgresql-test-rpm-macros:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-test:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-static:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-server:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-pltcl:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-plpython3:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-plperl:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-libs:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-help:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql-contrib:*:*:*:*:*:openeuler:*:*
- cpe:2.3:o:openeuler:postgresql:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2020-1067
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
