MGASA-2020-0365: postgresql11 Mageia

CVSS: UnknownPublished
Published 06-09-2020Last modified 16-04-2026
Open JSON

Vulnerability summary

MGASA-2020-0365 is a vulnerability in postgresql11 Mageia with no CVSS score yet.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 2 · Downstream 0
CVE-2020-14349CVE-2020-14350

Timeline

  1. 06-09-2020
    PublishedVulnerability first disclosed.
  2. 16-04-2026
    Last modifiedVulnerability information updated.

Description

Updated postgresql packages fix security vulnerabilities It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication. (CVE-2020-14349) It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. (CVE-2020-14350)

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Mageia2 products
  • postgresql11< 11.9-1.mga7
  • postgresql9.6< 9.6.19-1.mga7

1 vendor · 2 products

References

3 links