| VID |
25392 |
| Severity |
40 |
| Port |
5432 |
| Protocol |
TCP |
| Class |
DB |
| Detailed Description |
The version of PostgreSQL installed on the remote host is 10 prior to 10.22, 11 prior to 11.17, 12 prior to 12.12, 13 prior to 13.8, or 14 prior to 14.5. As such, it is potentially affected by a vulnerability :
- A vulnerability exists in postgresql. On this security issue an attack requires permission to create non-temporary objects in at least one schema, ability to lure or wait for an administrator to create or update an affected extension in that schema, and ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, the attacker can run arbitrary code as the victim role, which may be a superuser. Known-affected extensions include both PostgreSQL-bundled and non-bundled extensions. PostgreSQL blocks this attack in the core server, so there's no need to modify individual extensions. (CVE-2022-2625)
* References:
https://access.redhat.com/security/cve/CVE-2022-2625
* Platforms Affected:
PostgreSQL 14.x prior to 14.5
Any operating system Any version |
| Recommendation |
Upgrade to the latest version of PostgreSQL (14.5 or later), available from the PostgreSQL Web page at http://www.postgresql.org/download/ |
| Related URL |
CVE-2022-2625 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
