Test ID:	1.3.6.1.4.1.25623.1.0.144708
Category:	Databases
Title:	PostgreSQL 10.x < 10.14, 11.x < 11.9, 12.x < 12.4 Search Path Vulnerability - Windows
Summary:	PostgreSQL is prone to an uncontrolled search path element vulnerability in; logical replication.
Description:	Summary: PostgreSQL is prone to an uncontrolled search path element vulnerability in logical replication. Vulnerability Impact: The PostgreSQL search_path setting determines schemas searched for tables, functions, operators, etc. The CVE-2018-1058 fix caused most PostgreSQL-provided client applications to sanitize search_path, but logical replication continued to leave search_path unchanged. Users of a replication publisher or subscriber database can create objects in the public schema and harness them to execute arbitrary SQL functions under the identity running replication, often a superuser. Installations having adopted a documented secure schema usage pattern are not vulnerable. Affected Software/OS: PostgreSQL versions 10.x prior to 10.14, 11.x prior to 11.9 and 12.x prior to 12.4. Solution: Update to version 10.14, 11.9, 12.4 or later. CVSS Score: 4.6 CVSS Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-14349 https://security.gentoo.org/glsa/202008-13 https://bugzilla.redhat.com/show_bug.cgi?id=1865744 SuSE Security Announcement: openSUSE-SU-2020:1228 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html SuSE Security Announcement: openSUSE-SU-2020:1243 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html SuSE Security Announcement: openSUSE-SU-2020:1244 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html SuSE Security Announcement: openSUSE-SU-2020:1312 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html SuSE Security Announcement: openSUSE-SU-2020:1326 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html https://usn.ubuntu.com/4472-1/
Copyright	Copyright (C) 2020 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.