Incomplete Safeguards in PostgreSQL Allow Arbitrary SQL Function Execution
Summary
CVE-2022-1552: A flaw was found in PostgreSQL. Affects postgresql versions < 13.7-r0. Fixed in 13.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an open-source relational database management system known for its robustness, scalability, and extensibility. It is widely used in various applications and industries. However, a vulnerability has been discovered in PostgreSQL that could allow an attacker with certain permissions to execute arbitrary SQL functions under a superuser identity. This vulnerability affects the following packages: postgresql, postgresql13, postgresql14, and postgresql15 in the Alpine Linux ecosystem.
Vulnerability Detail
The vulnerability (CVE-2022-1552) arises from incomplete efforts to operate safely when a privileged user is maintaining another user's objects. Several commands, including Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck, activate relevant protections too late or not at all during the process. This flaw enables an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity. The impact of this vulnerability can be severe, as it allows unauthorized access and potential manipulation of the database.
How To Fix
Minimum fixed version
13.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the affected packages to the fixed versions.
Conclusion
The vulnerability in PostgreSQL (CVE-2022-1552) exposes a significant risk of unauthorized access and manipulation of the database. It is crucial to update the affected packages to the fixed versions to ensure the necessary safeguards are in place. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql →
FAQ
This vulnerability allows an attacker with certain permissions to execute arbitrary SQL functions under a superuser identity, potentially leading to unauthorized access and manipulation of the database.
The vulnerability affects the following packages in the Alpine Linux ecosystem: postgresql, postgresql13, postgresql14, and postgresql15.
No, there are no known workarounds for this vulnerability. It is crucial to update the affected packages to the fixed versions.
To fix this vulnerability, update the affected packages to the fixed versions: 13.7-r0 for postgresql, postgresql13, postgresql14, and postgresql15 in the Alpine Linux ecosystem.
You can find more information about this vulnerability in the CVE-2022-1552 JSON report available at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1552.json
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
