CVE-2020-14350

It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 9%
Affected Products (NVD)
VendorProductVersion
postgresqlpostgresql
9.5 ≤
𝑥
< 9.5.23
postgresqlpostgresql
9.6 ≤
𝑥
< 9.6.19
postgresqlpostgresql
10.0 ≤
𝑥
< 10.14
postgresqlpostgresql
11.0 ≤
𝑥
< 11.9
postgresqlpostgresql
12.0 ≤
𝑥
< 12.4
debiandebian_linux
9.0
opensuseleap
15.1
opensuseleap
15.2
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
20.04
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
postgresql-10
bionic
Fixed 10.14-0ubuntu0.18.04.1
released
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
dne
postgresql-12
bionic
dne
focal
Fixed 12.4-0ubuntu0.20.04.1
released
groovy
Fixed 12.4-1
released
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
dne
postgresql-9.1
bionic
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
dne
postgresql-9.3
bionic
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
deferred
xenial
dne
postgresql-9.5
bionic
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
dne
xenial
Fixed 9.5.23-0ubuntu0.16.04.1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libecpg6
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise sap 15 SP4
12.4-8.6.1
fixed
suse enterprise server 12 SP2
12.5-3.9.3
fixed
suse enterprise server 12 SP3
12.5-3.9.3
fixed
suse enterprise server 12 SP4
12.5-3.9.3
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP4
12.4-8.6.1
fixed
libpq5
suse enterprise desktop 15 SP1
12.4-3.11.1
fixed
suse enterprise desktop 15 SP2
12.4-8.6.1
fixed
suse enterprise desktop 15 SP3
12.4-8.6.1
fixed
suse enterprise desktop 15 SP4
12.4-8.6.1
fixed
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise sap 15 SP4
12.4-8.6.1
fixed
suse enterprise server 12 SP2
12.5-3.9.3
fixed
suse enterprise server 12 SP3
12.5-3.9.3
fixed
suse enterprise server 12 SP4
12.5-3.9.3
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP4
12.4-8.6.1
fixed
libpq5-32bit
suse enterprise desktop 15 SP1
12.4-3.11.1
fixed
suse enterprise desktop 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise server 12 SP2
12.5-3.9.3
fixed
suse enterprise server 12 SP3
12.5-3.9.3
fixed
suse enterprise server 12 SP4
12.5-3.9.3
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
postgresql10
suse enterprise desktop 15 SP1
10.14-8.19.1
fixed
suse enterprise desktop 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP3
10.14-8.19.1
fixed
suse enterprise server 12 SP2
10.15-4.9.1
fixed
suse enterprise server 12 SP3
10.15-4.9.1
fixed
suse enterprise server 12 SP4
10.15-4.9.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
suse enterprise server 15 SP3
10.14-8.19.1
fixed
postgresql10-contrib
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP3
10.14-8.19.1
fixed
suse enterprise server 12 SP2
10.15-4.9.1
fixed
suse enterprise server 12 SP3
10.15-4.9.1
fixed
suse enterprise server 12 SP4
10.15-4.9.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
suse enterprise server 15 SP3
10.14-8.19.1
fixed
postgresql10-devel
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP3
10.14-8.19.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
suse enterprise server 15 SP3
10.14-8.19.1
fixed
postgresql10-docs
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise server 12 SP2
10.15-4.9.1
fixed
suse enterprise server 12 SP3
10.15-4.9.1
fixed
suse enterprise server 12 SP4
10.15-4.9.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
postgresql10-plperl
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP3
10.14-8.19.1
fixed
suse enterprise server 12 SP2
10.15-4.9.1
fixed
suse enterprise server 12 SP3
10.15-4.9.1
fixed
suse enterprise server 12 SP4
10.15-4.9.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
suse enterprise server 15 SP3
10.14-8.19.1
fixed
postgresql10-plpython
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP3
10.14-8.19.1
fixed
suse enterprise server 12 SP2
10.15-4.9.1
fixed
suse enterprise server 12 SP3
10.15-4.9.1
fixed
suse enterprise server 12 SP4
10.15-4.9.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
suse enterprise server 15 SP3
10.14-8.19.1
fixed
postgresql10-pltcl
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP3
10.14-8.19.1
fixed
suse enterprise server 12 SP2
10.15-4.9.1
fixed
suse enterprise server 12 SP3
10.15-4.9.1
fixed
suse enterprise server 12 SP4
10.15-4.9.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
suse enterprise server 15 SP3
10.14-8.19.1
fixed
postgresql10-server
suse enterprise sap 15 SP1
10.14-8.19.1
fixed
suse enterprise sap 15 SP2
10.14-8.19.1
fixed
suse enterprise sap 15 SP3
10.14-8.19.1
fixed
suse enterprise server 12 SP2
10.15-4.9.1
fixed
suse enterprise server 12 SP3
10.15-4.9.1
fixed
suse enterprise server 12 SP4
10.15-4.9.1
fixed
suse enterprise server 15
10.14-4.25.1
fixed
suse enterprise server 15 SP1
10.14-8.19.1
fixed
suse enterprise server 15 SP2
10.14-8.19.1
fixed
suse enterprise server 15 SP3
10.14-8.19.1
fixed
postgresql12
suse enterprise desktop 15 SP1
12.4-3.11.1
fixed
suse enterprise desktop 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-contrib
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-devel
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-docs
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-plperl
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-plpython
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-pltcl
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-server
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql12-server-devel
suse enterprise sap 15 SP1
12.4-3.11.1
fixed
suse enterprise sap 15 SP2
12.4-8.6.1
fixed
suse enterprise sap 15 SP3
12.4-8.6.1
fixed
suse enterprise server 15 SP1
12.4-3.11.1
fixed
suse enterprise server 15 SP2
12.4-8.6.1
fixed
suse enterprise server 15 SP3
12.4-8.6.1
fixed
postgresql96
suse enterprise server 12 SP2
9.6.20-6.8.1
fixed
suse enterprise server 12 SP3
9.6.20-6.8.1
fixed
postgresql96-contrib
suse enterprise server 12 SP2
9.6.20-6.8.1
fixed
suse enterprise server 12 SP3
9.6.20-6.8.1
fixed
postgresql96-docs
suse enterprise server 12 SP2
9.6.20-6.8.1
fixed
suse enterprise server 12 SP3
9.6.20-6.8.1
fixed
postgresql96-plperl
suse enterprise server 12 SP2
9.6.20-6.8.1
fixed
suse enterprise server 12 SP3
9.6.20-6.8.1
fixed
postgresql96-plpython
suse enterprise server 12 SP2
9.6.20-6.8.1
fixed
suse enterprise server 12 SP3
9.6.20-6.8.1
fixed
postgresql96-pltcl
suse enterprise server 12 SP2
9.6.20-6.8.1
fixed
suse enterprise server 12 SP3
9.6.20-6.8.1
fixed
postgresql96-server
suse enterprise server 12 SP2
9.6.20-6.8.1
fixed
suse enterprise server 12 SP3
9.6.20-6.8.1
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html
https://bugzilla.redhat.com/show_bug.cgi?id=1865746
https://lists.debian.org/debian-lts-announce/2020/08/msg00028.html
https://security.gentoo.org/glsa/202008-13
https://security.netapp.com/advisory/ntap-20200918-0002/
https://usn.ubuntu.com/4472-1/
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html
https://bugzilla.redhat.com/show_bug.cgi?id=1865746
https://lists.debian.org/debian-lts-announce/2020/08/msg00028.html
https://security.gentoo.org/glsa/202008-13
https://security.netapp.com/advisory/ntap-20200918-0002/
https://usn.ubuntu.com/4472-1/