MGASA-2020-0365

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2020-0365.html
Import Source
https://advisories.mageia.org/MGASA-2020-0365.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2020-0365
Related
Published
2020-09-06T20:33:09Z
Modified
2020-09-06T19:54:53Z
Summary
Updated postgresql packages fix security vulnerabilities
Details

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication. (CVE-2020-14349)

It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. (CVE-2020-14350)

References
Credits

Affected packages

Mageia:7 / postgresql9.6

Package

Name
postgresql9.6
Purl
pkg:rpm/mageia/postgresql9.6?distro=mageia-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.6.19-1.mga7

Ecosystem specific 

{
    "section": "core"
}

Mageia:7 / postgresql11

Package

Name
postgresql11
Purl
pkg:rpm/mageia/postgresql11?distro=mageia-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
11.9-1.mga7

Ecosystem specific 

{
    "section": "core"
}