PostgreSQL — свободная объектно-реляционная система управления базами данных.
Релизный цикл, информация об уязвимостях
График релизов
Количество 1 017
CVE-2020-14349
It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.
CVE-2020-14349
It was found that PostgreSQL versions before 12.4, before 11.9 and bef ...
CVE-2020-14349
It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.
CVE-2020-14350
It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.
BDU:2021-00079
Уязвимость системы управления базами данных PostgreSQL, связанная с ненадежным путем поиска, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
CVE-2020-14349
It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.
CVE-2020-14350
It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.
SUSE-SU-2020:2149-1
Security update for postgresql10 and postgresql12
BDU:2023-00613
Уязвимость системы управления базами данных PostgreSQL, связанная с неконтролируемым элементом пути поиска, позволяющая нарушителю повысить свои привилегии и выполнить произвольные команды
BDU:2023-00612
Уязвимость установщика Windows installer системы управления базами данных PostgreSQL, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2020-14349 It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication. | CVSS3: 7.1 | 2% Низкий | больше 5 лет назад |
| CVE-2020-14349 It was found that PostgreSQL versions before 12.4, before 11.9 and bef ... | CVSS3: 7.1 | 2% Низкий | больше 5 лет назад |
 | CVE-2020-14349 It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication. | CVSS3: 7.1 | 2% Низкий | больше 5 лет назад |
| CVE-2020-14350 It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. | CVSS3: 7.3 | 0% Низкий | больше 5 лет назад |
 | BDU:2021-00079 Уязвимость системы управления базами данных PostgreSQL, связанная с ненадежным путем поиска, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании | CVSS3: 7.3 | 0% Низкий | больше 5 лет назад |
 | CVE-2020-14349 It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication. | CVSS3: 7.1 | 2% Низкий | больше 5 лет назад |
| CVE-2020-14350 It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. | CVSS3: 7.1 | 0% Низкий | больше 5 лет назад |
 | SUSE-SU-2020:2149-1 Security update for postgresql10 and postgresql12 | 0% Низкий | больше 5 лет назад | |
| BDU:2023-00613 Уязвимость системы управления базами данных PostgreSQL, связанная с неконтролируемым элементом пути поиска, позволяющая нарушителю повысить свои привилегии и выполнить произвольные команды | CVSS3: 7.5 | 2% Низкий | почти 6 лет назад |
| BDU:2023-00612 Уязвимость установщика Windows installer системы управления базами данных PostgreSQL, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код | CVSS3: 6.7 | 0% Низкий | почти 6 лет назад |
Уязвимостей на страницу