What’s Vulnerable › Vulnerabilities

CVE-2020-14350

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-08-24 · updated 2026-06-17
• Weakness: CWE-426

Description

It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.

Affected products

• Canonical Ubuntu Linux: 16.04, 18.04, 20.04
• Debian Linux: 9.0
• openSUSE Leap: 15.1, 15.2
• PostgreSQL: from 9.5 before 9.5.23; from 9.6 before 9.6.19; from 10.0 before 10.14; from 11.0 before 11.9; from 12.0 before 12.4 — fixed in 10.14, 11.9, 12.4, 9.5.23, 9.6.19

How to fix

Upgrade to a fixed version: PostgreSQL 10.14, 11.9, 12.4, 9.5.23. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1865746
• https://lists.debian.org/debian-lts-announce/2020/08/msg00028.html
• https://security.gentoo.org/glsa/202008-13
• https://security.netapp.com/advisory/ntap-20200918-0002/
• https://usn.ubuntu.com/4472-1/
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html

Get alerted when CVE-2020-14350 or the next vulnerability affects your stack