The vulnerabilities of the Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck components of the PostgreSQL database management system allow attackers to execute arbitrary SQL functions under the user’s account.

🗓️ 17 May 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Autovacuum, Reindex, Create Index, Refresh Materialized View, Cluster, and PostgreSQL amcheck flaws enable remote arbitrary SQL as a superuser.

Reporter	Title	Published	Views	Family All 280
ALT Linux	Security fix for the ALT Linux 9 package postgresql12 version 12.11-alt0.M90P.1	18 May 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package postgresql10 version 10.21-alt0.M90P.1	18 May 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package postgresql12-1C version 12.11-alt0.M90P.1	18 May 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql14 version 14.3-alt1	13 May 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql13 version 13.7-alt1	13 May 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql12 version 12.11-alt1	13 May 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql15 version 14.3-alt1	11 May 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql10 version 10.21-alt1	13 May 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql15-1C version 14.3-alt1	11 May 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package postgresql11 version 11.16-alt1	13 May 202200:00	–	altlinux

Vulners

Node

postgresql postgresqlRange<14.3

OR

postgresql postgresqlRange<13.7

OR

postgresql postgresqlRange<12.11

OR

postgresql postgresqlRange<11.16

OR

postgresql postgresqlRange<10.21

OR

postgres_professional postgres_pro_certifiedRange<11.16.2

OR

postgres_professional postgres_pro_certifiedRange<14.4.1

OR

red_hat red_hat_enterprise_linuxMatch8

Source	Link
postgresql	www.postgresql.org/support/security/CVE-2022-1552/
access	www.access.redhat.com/security/cve/cve-2022-1552
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-1552
git	www.git.postgresql.org/gitweb/
git	www.git.postgresql.org/gitweb/
postgresql	www.postgresql.org/about/news/postgresql-143-137-1211-1116-and-1021-released-2449/
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
goslinux	www.goslinux.fssp.gov.ru/2726972/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.5.1/
wiki	www.wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47

05 Mar 2025 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 38.8

CVSS 29

EPSS0.11726

Autovacuum vulnerability Reindex vulnerability Create Index vulnerability Refresh Materialized View Cluster vulnerability PostgreSQL amcheck vulnerability Remote execution Superuser access