Msrc Cm1 Postgresql 12.7-1 On Cbl Mariner 1.0 vulnerabilities

CVE-2021-32027 [HIGH] CWE-190 A flaw was found in postgresql in versions before 13.3 before 12.7 before 11.12 before 10.17 and before 9.6.22. While modifying certain SQL array values missing bounds checks let authenticated databas A flaw was found in postgresql in versions before 13.3 before 12.7 before 11.12 before 10.17 and before 9.6.22. While modifying certain SQL array values missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The hi

CVE-2020-25696 [HIGH] CWE-183 A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1 before 12.5 before 11.10 before 10.15 before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1 before 12.5 before 11.10 before 10.15 before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server the attacker can execute arbitrar

CVE-2020-25694 [HIGH] CWE-327 A flaw was found in PostgreSQL versions before 13.1 before 12.5 before 11.10 before 10.15 before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reu A flaw was found in PostgreSQL versions before 13.1 before 12.5 before 11.10 before 10.15 before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant

CVE-2020-25695 [HIGH] CWE-89 A flaw was found in PostgreSQL versions before 13.1 before 12.5 before 11.10 before 10.15 before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one A flaw was found in PostgreSQL versions before 13.1 before 12.5 before 11.10 before 10.15 before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a su

CVE-2020-10733 [HIGH] CWE-426 The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker

CVE-2020-14349 [HIGH] CWE-89 It was found that PostgreSQL versions before 12.4 before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an It was found that PostgreSQL versions before 12.4 before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058 in order to execute arbitrary SQL com

CVE-2020-14350 [HIGH] CWE-426 It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into exec It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script during the installation or update of

CVE-2020-1720 [LOW] CWE-862 A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION" where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to pe A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION" where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function triggers et al. leading to database