PostgreSQL 10.x < 10.22, 11.x < 11.17, 12.x < 12.12, 13.x < 13.8, 14.x < 14.5 Extension Vulnerability - Linux

PostgreSQL is prone to a vulnerability where extension scripts replace objects not belonging to the extension. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

PostgreSQL 10.x < 10.22, 11.x < 11.17, 12.x < 12.12, 13.x < 13.8, 14.x < 14.5 Extension Vulnerability - Windows

PostgreSQL is prone to a vulnerability where extension scripts replace objects not belonging to the extension. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

CVE-2022-2625

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the objec...

The vulnerability of the PostgreSQL database management system, related to errors when using OR commands with extensions, allows a perpetrator to increase their privileges and replace arbitrary objects in the database.

The vulnerability of the PostgreSQL database management system is related to errors that occur when using OR commands with extensions. Exploiting this vulnerability allows a malicious actor to increase their privileges and replace arbitrary objects in the database...

UBUNTU-CVE-2022-2625

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the objec...

OESA-2022-1835 postgresql-jdbc security update

PostgreSQL JDBC Driver PgJDBC for short allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java Type 4, and communicates in the PostgreSQL native network protocol. Security Fixes: PostgreSQL JDBC...

Debian: Security Advisory (DLA-3072-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-35942 loopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` Filter

Improper input validation on the contains LoopBack filter may allow for arbitrary SQL injection. When the extended filter property contains is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data...

CVE-2021-3677 affecting package postgresql 12.7-2

CVE-2021-3677 affecting package postgresql 12.7-2. An upgraded version of the package is available that resolves this issue...

SUSE-FU-2022:2794-1 Feature update for ongres-scram, ongres-stringprep, postgresql-jdbc

This feature update for ongres-scram, ongres-stringprep, postgresql-jdbc provides: ongres-scram: - Upgrade from version 1.0.0-beta.2 to version 2.1. jscSLE-23994 Add standard SASLPrep bsc1196693, jscSLE-23994 Failover to bouncy castle implementation of PBKDF2WithHmacSHA256 to support Oracle JDK 7...

SQL Injection

loopback-connector-postgresql is vulnerable to sql injection attacks. The vulnerability exists in buildExpression function in postgresql.js because the user provided inputs for contains loopback filter are not properly sanitized which allows an attacker to inject and execute arbitrary sql command...

loopback-connector-postgresql SQL注入漏洞

loopback-connector-postgresql is a PostgreSQL connector for the OpenJS Foundation's LoopBack framework. A SQL injection vulnerability exists in loopback-connector-postgresql. An attacker could use this vulnerability to inject arbitrary sql, which could affect the confidentiality and integrity of...

GHSA-J259-6C58-9M58 loopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` Filter

Improper input validation on the contains LoopBack filter may allow for arbitrary SQL injection. Impact When the extended filter property contains is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of...

The cloud has an isolation problem: PostgreSQL vulnerabilities affect multiple cloud vendors

How Wiz Research uncovered multiple related vulnerabilities in PostgreSQL-as-a-Service offerings from GCP, Azure, and others...

[SECURITY] [DLA 3072-1] postgresql-11 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3072-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort August 11, 2022 https://wiki.debian.org/LTS -...

KLA15718 RCE vulnerability in PostgreSQL

Remote code execution vulnerability was found in PostgreSQL. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories PostgreSQL: CVE-2022-2625 Related products PostgreSQL CVE list CVE-2022-2625 critical Solution Update to the latest version Download PostgreSQ...

PostgreSQL 安全漏洞

PostgreSQL is a free object-relational database management system from the PostgreSQL organization. The system supports most of the SQL standards and provides many other features such as foreign keys, triggers, views, and more. A security vulnerability exists in PostgreSQL, which can be exploited...

Debian dla-3072 : libecpg-compat3 - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3072 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3072-1 [email protected] https://www.debian.org/lts/security/...

DLA-3072-1 postgresql-11 - security update

Bulletin has no description...

Vulnerability in core server (CVE-2022-2625)

Extension scripts replace objects not belonging to the extension Some extensions use CREATE OR REPLACE or CREATE IF NOT EXISTS commands. Some don't adhere to the documented rule to target only objects known to be extension members already. An attack requires permission to create non-temporary...