CVE-2020-14349

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication....

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami postgresql

[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.14.0"},{"introduced":"11.0.0"},{"fixed":"11.9.0"},{"introduced":"12.0.0"},{"fixed":"12.4.0"}]}]

参照URL

advisory lists.opensuse.org
advisory lists.opensuse.org
advisory lists.opensuse.org
advisory lists.opensuse.org
advisory lists.opensuse.org
advisory bugzilla.redhat.com
advisory security.gentoo.org
advisory security.netapp.com
advisory usn.ubuntu.com
web nvd.nist.gov