CVE-2021-38140

The CVE-2021-38140 entry concerns the PostgreSQL set_user extension module (before version 2.0.1). The vulnerability enables privilege escalation via RESET SESSION AUTHORIZATION after a successful set_user() call. The root cause is an improper handling of session authorization state in the set_us...

CVE-2021-41558

The CVE-2021-41558 entry concerns the set_user extension module for PostgreSQL, affected in versions before 3.0.0. The root cause is a bypass of the ProcessUtility_hook via set_config, enabling an unintended execution path. The vulnerability is described as allowing a bypass with potential elevat...