PostgreSQL 10.x < 10.21, 11.x < 11.16, 12.x < 12.11, 13.x < 13.7, 14.x < 14.3 Privilege Escalation Vulnerability - Windows

PostgreSQL is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

GHSA-QFWQ-CHF4-JVWG karo Metacharacter Handling Remote Command Execution

The karo gem through 2.5.2 for Ruby allows Remote command injection via the host field. A flaw in db.rb is triggered when handling metacharacters. This may allow a remote attacker to execute arbitrary commands. In particular lines 76 and 95 as of 2014-06-01 pass unsanitized user supplied input to...

CVE-2022-1552

A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck commands activated relevant protections too late or no...

GHSA-837X-XWW6-7JQM PostgreSQL PL/Java Improper Privilege Management

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath...

PostgreSQL PL/Java Improper Privilege Management

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath...

Vulnerability fixed in PostgreSQL

The developers of PostgreSQL have fixed a vulnerability in PostgreSQL. It was found that certain commands such as Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER and pgamcheck do not handle permissions correctly, allowing a user to can execute these commands outside the scop...

Debian: Security Advisory (DSA-5136-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-5135-1 : postgresql-11 - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dsa-5135 advisory. Alexander Lakhin discovered that the autovacuum feature and multiple commands could escape the security- restricted operation sandbox. For additional information please...

Debian: Security Advisory (DSA-5135-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-5136-1 : postgresql-13 - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5136 advisory. Alexander Lakhin discovered that the autovacuum feature and multiple commands could escape the security- restricted operation sandbox. For additional information please...

[SECURITY] [DSA 5136-1] postgresql-13 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5136-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 12, 2022 https://www.debian.org/security/faq -...

[SECURITY] [DSA 5135-1] postgresql-11 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5135-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 12, 2022 https://www.debian.org/security/faq -...

UBUNTU-CVE-2022-1552

A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck commands activated relevant protections too late or no...

AlmaLinux 8 : postgresql:10 (ALSA-2022:1830)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:1830 advisory. postgresql: server processes unencrypted bytes from man-in-the-middle CVE-2021-23214 Tenable has extracted the preceding description block directly from the...

FreeBSD : PostgreSQL Server -- execute arbitrary SQL code as DBA user (157ce083-d145-11ec-ab9b-6cc21735f730)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 157ce083-d145-11ec-ab9b-6cc21735f730 advisory. - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a...

DSA-5136-1 postgresql-13 - security update

Bulletin has no description...

DSA-5135-1 postgresql-11 - security update

Bulletin has no description...

KLA12537 PE vulnerability in PostgreSQL

Escalation of privilege vulnerability was found in PostgreSQL. Malicious users can exploit this vulnerability to execute arbitrary code, gain privileges. Original advisories PostgreSQL News Related products PostgreSQL CVE list CVE-2022-1552 critical Solution Update to the latest version Download...

Vulnerability in core server (CVE-2022-1552)

Autovacuum, REINDEX, and others omit "security restricted operation" sandbox Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck made incomplete efforts to operate safely when a privileged user is maintaining another user's objects. Those commands activated releva...

PostgreSQL 权限许可和访问控制问题漏洞

PostgreSQL is a free object-relational database management system from the PostgreSQL organization. The system supports most of the SQL standards and provides many other features such as foreign keys, triggers, views, and more. A permission and access control issue exists in PostgreSQL due to a...