SQL Command Injection Vulnerability in PostgreSQL Database
CVE-2020-14349

7.1HIGH

Key Information:

Vendor

Postgresql
Status
Postgresql
Vendor
CVE Published:
24 August 2020

What is CVE-2020-14349?

A vulnerability exists in PostgreSQL that could allow an authenticated attacker to manipulate the search_path during logical replication in order to execute arbitrary SQL commands within the replication user's context. This flaw emphasizes the importance of proper sanitization in database operations to protect against potential unauthorized actions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

PostgreSQL PostgreSQL versions before 12.4, before 11.9 and before 10.14

References

http://lists.opensuse.org/opensuse-security-announce/2020...
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020...
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020...
vendor-advisoryx_refsource_SUSE

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.