CVE-2022-1552
Published: 12 May 2022
A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity.
Priority
CVSS 3 base score: 8.8
Status
| Package | Release | Status |
|---|---|---|
|
postgresql-10 Launchpad, Ubuntu, Debian |
bionic |
Released
(10.21-0ubuntu0.18.04.1)
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
postgresql-12 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Released
(12.11-0ubuntu0.20.04.1)
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
postgresql-13 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| impish |
Released
(13.7-0ubuntu0.21.10.1)
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(13.7)
|
|
| xenial |
Does not exist
|
|
|
postgresql-14 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Released
(14.3-0ubuntu0.22.04.1)
|
|
| kinetic |
Not vulnerable
(14.3-1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(14.3)
|
|
| xenial |
Does not exist
|
|
|
Patches: upstream: https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=ab49ce7c3414ac19e4afb386d7843ce2d2fb8bda (REL_14_3) upstream: https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=677a494789062ca88e0142a17bedd5415f6ab0aa (REL_14_3) |
||
|
postgresql-9.1 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
postgresql-9.3 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| trusty |
Deferred
(2019-08-23)
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
postgresql-9.5 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(9.5.25-0ubuntu0.16.04.1+esm2)
|
|
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1552
- https://www.postgresql.org/about/news/postgresql-143-137-1211-1116-and-1021-released-2449/
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=ab49ce7c3414ac19e4afb386d7843ce2d2fb8bda (REL_14_3)
- https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=677a494789062ca88e0142a17bedd5415f6ab0aa (REL_14_3)
- https://ubuntu.com/security/notices/USN-5440-1
- https://ubuntu.com/security/notices/USN-5676-1
- NVD
- Launchpad
- Debian