Authorization Flaw in PostgreSQL Affecting Multiple Versions

CVE-2020-1720

What is CVE-2020-1720?

A flaw exists within PostgreSQL's handling of the 'ALTER ... DEPENDS ON EXTENSION' command, where sub-commands fail to conduct proper authorization checks. This oversight allows an authenticated attacker, under specific configurations, to potentially execute drop commands on critical database objects such as functions and triggers. The result could lead to significant database corruption, affecting the integrity and availability of stored data. Affected versions include PostgreSQL versions prior to 12.2, 11.7, 10.12, and 9.6.17, necessitating immediate attention to mitigate associated risks.

References