Описание
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
A flaw was found in pg_partman. A low-privileged database user with specific INSERT and UPDATE permissions can exploit a SQL injection issue in the create_partition_time function. This allows the user to store malicious SQL code, which is later executed with superuser privileges by the pg_partman_bgw background worker. This can lead to privilege escalation, enabling a complete compromise of the database and potential execution of operating-system commands as the PostgreSQL service account.
Отчет
This vulnerability is rated as having a Critical severity because an authenticated database user with standard partition maintenance privileges can escalate to full PostgreSQL superuser access. In environments running the pg_partman background worker daemon, unsanitized configuration values stored in partition metadata are executed with elevated administrative rights during automated partition creation. This grants unauthorized actors complete administrative control over the database environment and permits running host-level system commands with the privileges of the underlying service account.
Ссылки на источники
Дополнительная информация
Статус:
EPSS
9.9 Critical
CVSS3
Связанные уязвимости
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.
pg_partman is a PostgreSQL extension that manages partitioned tables b ...
ALT-PU-2026-11787: package `postgresql15-pg_partman` update to version 5.5.0-alt1
ALT-PU-2026-11786: package `postgresql16-pg_partman` update to version 5.5.0-alt1
EPSS
9.9 Critical
CVSS3