HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2022-1552

CVSS 8.8v3.1pub. 2022-08-31upd. 2024-11-21

A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • PostgreSQL

    APP
    Postgresql
    10.0 – 10.21 (excl.)11.0 – 11.16 (excl.)12.0 – 12.11 (excl.)13.0 – 13.7 (excl.)14.0 – 14.3 (excl.)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2015-0244CRITICAL9.8PL ✓same product

SQL injection w PostgreSQL przez błąd synchronizacji protokołu

CVE-2015-3166CRITICAL9.8PL ✓same product

PostgreSQL: błąd obsługi błędów systemowych w implementacji snprintf

CVE-2019-10211CRITICAL9.8PL ✓same product

PostgreSQL Windows Installer — wykonanie kodu z niezabezpieczonego katalogu (OpenSSL)

CVE-2018-16850CRITICAL9.8PL ✓same product

SQL injection w PostgreSQL via CREATE TRIGGER — wykonanie kodu z uprawnieniami superusera

CVE-2018-1115CRITICAL9.1PL ✓same product

PostgreSQL adminpack: brak kontroli ACL w funkcji pg_logfile_rotate()