Arbitrary Code Execution Vulnerability in PostgreSQL by PostgreSQL Global Development Group

CVE-2022-2625

Summary

This vulnerability in PostgreSQL allows an attacker with the required permissions to leverage the ability to create non-temporary objects in a schema. By luring or waiting for an administrator to create or update an affected extension, the attacker can gain the ability to execute arbitrary code with the same privileges as the victim role, potentially including superuser rights. Successful exploitation necessitates a strategic combination of user interaction and permission manipulation, making it crucial for users to apply timely updates and implement security best practices.

References