CVE-2020-14350

CVE	CVE-2020-14350
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-08-24 13:15:00 UTC
Updated	2023-01-24 02:38:00 UTC
Description	It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.

Problem Types: CWE-426

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Canonical	Ubuntu Linux	16.04	All	All	All
Operating System	Canonical	Ubuntu Linux	18.04	All	All	All
Operating System	Canonical	Ubuntu Linux	20.04	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Operating System	Opensuse	Leap	15.1	All	All	All
Operating System	Opensuse	Leap	15.2	All	All	All
Operating System	Opensuse	Leap	15.1	All	All	All
Operating System	Opensuse	Leap	15.2	All	All	All
Application	Postgresql	Postgresql	All	All	All	All
Application	Postgresql	Postgresql	All	All	All	All

Reference	Source	Link	Tags
August 2020 PostgreSQL Vulnerabilities in NetApp Products \| NetApp Product Security	CONFIRM	security.netapp.com
PostgreSQL: Multiple vulnerabilities (GLSA 202008-13) — Gentoo security	GENTOO	security.gentoo.org	Third Party Advisory
[security-announce] openSUSE-SU-2020:1243-1: important: Security update	SUSE	lists.opensuse.org	Mailing List, Third Party Advisory
[security-announce] openSUSE-SU-2020:1312-1: important: Security update	SUSE	lists.opensuse.org
[security-announce] openSUSE-SU-2020:1244-1: important: Security update	SUSE	lists.opensuse.org	Mailing List, Third Party Advisory
USN-4472-1: PostgreSQL vulnerabilities \| Ubuntu security notices \| Ubuntu	UBUNTU	usn.ubuntu.com
[security-announce] openSUSE-SU-2020:1326-1: important: Security update	SUSE	lists.opensuse.org
[security-announce] openSUSE-SU-2020:1228-1: moderate: Security update f	SUSE	lists.opensuse.org	Mailing List, Third Party Advisory
[security-announce] openSUSE-SU-2020:1227-1: moderate: Security update f	SUSE	lists.opensuse.org	Mailing List, Third Party Advisory
1865746 – (CVE-2020-14350) CVE-2020-14350 postgresql: Uncontrolled search path element in CREATE EXTENSION	MISC	bugzilla.redhat.com	Issue Tracking, Third Party Advisory
[SECURITY] [DLA 2331-1] posgresql-9.6 security update	DEBIAN	lists.debian.org	Mailing List, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

159270 Oracle Enterprise Linux Security Update for rh-postgresql10-postgresql (ELSA-2021-9290)
178017 Debian Security Update for postgresql-9.6 (DLA 2331-1)
377113 Alibaba Cloud Linux Security Update for postgresql:12 (ALINUX3-SA-2021:0017)
500539 Alpine Linux Security Update for postgresql
502007 Alpine Linux Security Update for postgresql14
502161 Alpine Linux Security Update for postgresql12
502773 Alpine Linux Security Update for postgresql15
504306 Alpine Linux Security Update for postgresql14
900047 CBL-Mariner Linux Security Update for postgresql 12.1
903144 Common Base Linux Mariner (CBL-Mariner) Security Update for postgresql (2015)
940130 AlmaLinux Security Update for postgresql:12 (ALSA-2020:5620)
940299 AlmaLinux Security Update for postgresql:9.6 (ALSA-2020:5619)
960242 Rocky Linux Security Update for postgresql:12 (RLSA-2020:5620)