CVE-2020-14350

It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 41%
Affected Products (NVD)
VendorProductVersion
postgresqlpostgresql
9.5 ≤
𝑥
< 9.5.23
postgresqlpostgresql
9.6 ≤
𝑥
< 9.6.19
postgresqlpostgresql
10.0 ≤
𝑥
< 10.14
postgresqlpostgresql
11.0 ≤
𝑥
< 11.9
postgresqlpostgresql
12.0 ≤
𝑥
< 12.4
debiandebian_linux
9.0
opensuseleap
15.1
opensuseleap
15.2
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
20.04
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
postgresql-10
bionic
Fixed 10.14-0ubuntu0.18.04.1
released
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
dne
postgresql-12
bionic
dne
focal
Fixed 12.4-0ubuntu0.20.04.1
released
groovy
Fixed 12.4-1
released
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
dne
postgresql-9.1
bionic
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
dne
postgresql-9.3
bionic
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
deferred
xenial
dne
postgresql-9.5
bionic
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
Fixed 9.5.23-0ubuntu0.16.04.1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libecpg6
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise sap 15 SP4
12.4-8.6.1
fixed
suse enterprise server 12 SP2
12.5-3.9.3
fixed
suse enterprise server 12 SP3
12.5-3.9.3
fixed
suse enterprise server 12 SP4
12.5-3.9.3
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP4
12.4-8.6.1
fixed
libpq5
suse enterprise desktop 15 SP1
12.4-3.11.1
fixed
suse enterprise desktop 15 SP2
12.4-8.6.1
fixed
suse enterprise desktop 15 SP3
12.4-8.6.1
fixed
suse enterprise desktop 15 SP4
12.4-8.6.1
fixed
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise sap 15 SP4
12.4-8.6.1
fixed
suse enterprise server 12 SP2
12.5-3.9.3
fixed
suse enterprise server 12 SP3
12.5-3.9.3
fixed
suse enterprise server 12 SP4
12.5-3.9.3
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP4
12.4-8.6.1
fixed
libpq5-32bit
suse enterprise desktop 15 SP1
12.4-3.11.1
fixed
suse enterprise desktop 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise server 12 SP2
12.5-3.9.3
fixed
suse enterprise server 12 SP3
12.5-3.9.3
fixed
suse enterprise server 12 SP4
12.5-3.9.3
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
postgresql10
suse enterprise desktop 15 SP1
10.14-8.19.1
fixed
suse enterprise desktop 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP3
10.14-8.19.1
fixed
suse enterprise server 12 SP2
10.15-4.9.1
fixed
suse enterprise server 12 SP3
10.15-4.9.1
fixed
suse enterprise server 12 SP4
10.15-4.9.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
suse enterprise server 15 SP3
10.14-8.19.1
fixed
postgresql10-contrib
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP3
10.14-8.19.1
fixed
suse enterprise server 12 SP2
10.15-4.9.1
fixed
suse enterprise server 12 SP3
10.15-4.9.1
fixed
suse enterprise server 12 SP4
10.15-4.9.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
suse enterprise server 15 SP3
10.14-8.19.1
fixed
postgresql10-devel
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP3
10.14-8.19.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
suse enterprise server 15 SP3
10.14-8.19.1
fixed
postgresql10-docs
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise server 12 SP2
10.15-4.9.1
fixed
suse enterprise server 12 SP3
10.15-4.9.1
fixed
suse enterprise server 12 SP4
10.15-4.9.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
postgresql10-plperl
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP3
10.14-8.19.1
fixed
suse enterprise server 12 SP2
10.15-4.9.1
fixed
suse enterprise server 12 SP3
10.15-4.9.1
fixed
suse enterprise server 12 SP4
10.15-4.9.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
suse enterprise server 15 SP3
10.14-8.19.1
fixed
postgresql10-plpython
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP3
10.14-8.19.1
fixed
suse enterprise server 12 SP2
10.15-4.9.1
fixed
suse enterprise server 12 SP3
10.15-4.9.1
fixed
suse enterprise server 12 SP4
10.15-4.9.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
suse enterprise server 15 SP3
10.14-8.19.1
fixed
postgresql10-pltcl
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP3
10.14-8.19.1
fixed
suse enterprise server 12 SP2
10.15-4.9.1
fixed
suse enterprise server 12 SP3
10.15-4.9.1
fixed
suse enterprise server 12 SP4
10.15-4.9.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
suse enterprise server 15 SP3
10.14-8.19.1
fixed
postgresql10-server
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP3
10.14-8.19.1
fixed
suse enterprise server 12 SP2
10.15-4.9.1
fixed
suse enterprise server 12 SP3
10.15-4.9.1
fixed
suse enterprise server 12 SP4
10.15-4.9.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
suse enterprise server 15 SP3
10.14-8.19.1
fixed
postgresql12
suse enterprise desktop 15 SP1
12.4-3.11.1
fixed
suse enterprise desktop 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-contrib
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-devel
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-docs
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-plperl
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-plpython
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-pltcl
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-server
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-server-devel
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql96
suse enterprise server 12 SP2
9.6.20-6.8.1
fixed
suse enterprise server 12 SP3
9.6.20-6.8.1
fixed
postgresql96-contrib
suse enterprise server 12 SP2
9.6.20-6.8.1
fixed
suse enterprise server 12 SP3
9.6.20-6.8.1
fixed
postgresql96-docs
suse enterprise server 12 SP2
9.6.20-6.8.1
fixed
suse enterprise server 12 SP3
9.6.20-6.8.1
fixed
postgresql96-plperl
suse enterprise server 12 SP2
9.6.20-6.8.1
fixed
suse enterprise server 12 SP3
9.6.20-6.8.1
fixed
postgresql96-plpython
suse enterprise server 12 SP2
9.6.20-6.8.1
fixed
suse enterprise server 12 SP3
9.6.20-6.8.1
fixed
postgresql96-pltcl
suse enterprise server 12 SP2
9.6.20-6.8.1
fixed
suse enterprise server 12 SP3
9.6.20-6.8.1
fixed
postgresql96-server
suse enterprise server 12 SP2
9.6.20-6.8.1
fixed
suse enterprise server 12 SP3
9.6.20-6.8.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
postgresql95
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-contrib
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-debuginfo
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-devel
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-docs
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-libs
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-plperl
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-plpython26
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-plpython27
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-server
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-static
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql95-test
Amazon Linux 1
0:9.5.23-1.81.amzn1
fixed
postgresql96
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-contrib
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-debuginfo
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-devel
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-docs
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-libs
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-plperl
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-plpython26
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-plpython27
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-server
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-static
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
postgresql96-test
Amazon Linux 1
0:9.6.19-1.83.amzn1
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
postgresql
CBL-Mariner 1.0
0:12.7-1.cm1
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html
https://bugzilla.redhat.com/show_bug.cgi?id=1865746
https://lists.debian.org/debian-lts-announce/2020/08/msg00028.html
https://security.gentoo.org/glsa/202008-13
https://security.netapp.com/advisory/ntap-20200918-0002/
https://usn.ubuntu.com/4472-1/
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html
https://bugzilla.redhat.com/show_bug.cgi?id=1865746
https://lists.debian.org/debian-lts-announce/2020/08/msg00028.html
https://security.gentoo.org/glsa/202008-13
https://security.netapp.com/advisory/ntap-20200918-0002/
https://usn.ubuntu.com/4472-1/