Vulnerability in client (CVE-2020-25694)

Reconnection can downgrade connection security settings Many PostgreSQL-provided client applications have options that create additional database connections. Some of those applications reuse only the basic connection parameters e.g. host, user, port, dropping others. If this drops a...

Vulnerability in core server (CVE-2020-14350)

Uncontrolled search path element in CREATE EXTENSION When a superuser runs certain CREATE EXTENSION statements, users may be able to execute arbitrary SQL functions under the identity of that superuser. The attacker must have permission to create objects in the new extension's schema or a schema ...

Vulnerability in core server (CVE-2020-14349)

Uncontrolled search path element in logical replication The PostgreSQL searchpath setting determines schemas searched for tables, functions, operators, etc. The CVE-2018-1058 fix caused most PostgreSQL-provided client applications to sanitize searchpath, but logical replication continued to leave...

Vulnerability in packaging (CVE-2020-10733)

Windows installer runs executables from uncontrolled directories The Windows installer for PostgreSQL invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intend...

Vulnerability in core server (CVE-2020-1720)

ALTER ... DEPENDS ON EXTENSION is missing authorization checks. The ALTER ... DEPENDS ON EXTENSION sub-commands do not perform authorization checks, which can allow an unprivileged user to drop any function, procedure, materialized view, index, or trigger under certain conditions. This attack is...

Vulnerability in core server (CVE-2014-8161)

Constraint violation errors can cause display of values in columns which the user would not normally have rights to see...

Vulnerability in packaging (CVE-2019-3466)

pgctlcluster script in postgresql-common does not drop privileges when creating socket/statistics temporary directories A PostgreSQL superuser could escalate to root using a deficiency in the pgctlcluster command. pgctlcluster is a utility provided by the "postgresql-common" package that is...

Vulnerability in packaging (CVE-2019-10211)

Windows installer bundled OpenSSL executes code from unprotected directory When the database server or libpq client library initializes SSL, libeay32.dll attempts to read configuration from a hard-coded directory. Typically, the directory does not exist, but any local user could create it and...

Vulnerability in packaging (CVE-2019-10210)

Windows installer writes superuser password to unprotected temporary file The EnterpriseDB Windows installer writes a password to a temporary file in its installation directory, creates initial databases, and deletes the file. During those seconds while the file exists, a local attacker can read...

Vulnerability in core server (CVE-2019-10208)

TYPE in pgtemp executes arbitrary SQL during SECURITY DEFINER execution Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary SQL under the identity of the function owner. An attack requires EXECUTE permission on the function, which must itself contain a function call havi...

Vulnerability in core server (CVE-2019-10209)

Memory disclosure in cross-type comparison for hashed subplan In a database containing hypothetical, user-defined hash equality operators, an attacker could read arbitrary bytes of server memory. For an attack to become possible, a superuser would need to create unusual operators. It is possible...

Vulnerability in core server (CVE-2019-10164)

Stack-based buffer overflow via setting a password An authenticated user could create a stack-based buffer overflow by changing their own password to a purpose-crafted value. In addition to the ability to crash the PostgreSQL server, this could be further exploited to execute arbitrary code as th...

Vulnerability in core server (CVE-2019-10130)

Selectivity estimators bypass row security policies PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user able to execute SQL queries with permissions to read a given column could...

Vulnerability in core server (CVE-2019-10129)

Memory disclosure in partition routing Prior to this release, a user running PostgreSQL 11 can read arbitrary bytes of server memory by executing a purpose-crafted INSERT statement to a partitioned table...

Vulnerability in packaging (CVE-2019-10128)

EnterpriseDB Windows installer does not clear permissive ACL entries Due to both the EnterpriseDB and BigSQL Windows installers not locking down the permissions of the PostgreSQL binary installation directory and the data directory, an unprivileged Windows user account and an unprivileged...

Vulnerability in packaging (CVE-2019-10127)

BigSQL Windows installer does not clear permissive ACL entries. Due to both the EnterpriseDB and BigSQL Windows installers not locking down the permissions of the PostgreSQL binary installation directory and the data directory, an unprivileged Windows user account and an unprivileged PostgreSQL...

Vulnerability in core server (CVE-2018-16850)

SQL injection in pgupgrade and pgdump, via CREATE TRIGGER ... REFERENCING...

Vulnerability in client (CVE-2018-10915)

Certain host connection parameters defeat client-side security defenses...

Vulnerability in core server (CVE-2018-10925)

Memory disclosure and missing authorization in INSERT ... ON CONFLICT DO UPDATE...

Vulnerability in contrib module (CVE-2018-1115)

Too-permissive access control list on function pglogfilerotate...

Vulnerability in client (CVE-2018-1058)

Uncontrolled search path element in pgdump and other client applications...

Vulnerability in client (CVE-2018-1053)

pgupgrade creates file of sensitive metadata under prevailing umask...

Vulnerability in core server (CVE-2018-1052)

Memory disclosure in table partitioning...

Vulnerability in core server (CVE-2017-15098)

Memory disclosure in JSON functions...

Vulnerability in core server (CVE-2017-7548)

loput function ignores ACLs...

Vulnerability in contrib module (CVE-2017-12172)

Start scripts permit database administrator to modify root-owned files...

Vulnerability in core server (CVE-2017-15099)

INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges...

Vulnerability in core server (CVE-2017-7547)

pgusermappings view discloses passwords to users lacking server privileges...

Vulnerability in core server (CVE-2017-7546)

empty password accepted in some authentication methods...

Vulnerability in client (CVE-2017-7485)

libpq ignores PGREQUIRESSL environment variable...

Vulnerability in core server (CVE-2017-7484)

selectivity estimators bypass SELECT privilege checks...

Vulnerability in core server (CVE-2017-7486)

pgusermappings view discloses foreign server passwords...

Vulnerability in packaging (CVE-2016-7048)

Interactive installer downloads software over plain HTTP, then executes it...

Vulnerability in core server (CVE-2016-5423)

Certain nested CASE/WHEN expressions can crash server...

Vulnerability in client (CVE-2016-5424)

Exceptional database and role names could enable escalation to superuser...

Vulnerability in core server (CVE-2016-2193)

Plan cache might use wrong role context for RLS policy...

Vulnerability in contrib module (CVE-2016-3065)

pageinspect does not check permissions for BRIN indexes...

Vulnerability in core server (CVE-2016-0773)

Unchecked regex can crash the server...

Vulnerability in core server (CVE-2015-5289)

Unchecked JSON input can crash the server...

Vulnerability in contrib module (CVE-2015-5288)

Memory leak in crypt function...

Vulnerability in contrib module (CVE-2015-3167)

pgcrypto has multiple error messages for decryption with an incorrect key...

Vulnerability in core server (CVE-2015-3165)

Double "free" after authentication timeout...

Vulnerability in core server (CVE-2015-3166)

Unanticipated errors from the standard library...

Vulnerability in core server (CVE-2015-0242)

Buffer overrun in replacement printf family of functions...

Vulnerability in core server (CVE-2015-0241)

Buffer overruns in "tochar" functions...

Vulnerability in contrib module (CVE-2015-0243)

Memory errors in functions in the pgcrypto extension...

Vulnerability in core server (CVE-2015-0244)

An error in extended protocol message reading...

Vulnerability in core server (CVE-2014-0064)

Potential buffer overruns due to integer overflow in size calculations...

Vulnerability in contrib module (CVE-2014-0066)

Potential null pointer dereference crash when crypt3 returns NULL...

Vulnerability in core server (CVE-2014-0065)

Potential buffer overruns of fixed-size buffers...