RHSA-2020:5661HighCVSS 8.8

Red Hat Security Advisory: postgresql:9.6 security update

Published
December 22, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (7)

CVE-2019-10130 →CVE-2019-10208 →CVE-2020-1720 →CVE-2020-14350 →CVE-2020-25694 →CVE-2020-25695 →CVE-2020-25696 →

📋 Description

CVE-2019-10130 — postgresql: Selectivity estimators bypass row security policies CVE-2019-10208 — postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution CVE-2020-1720 — postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks CVE-2020-14350 — postgresql: Uncontrolled search path element in CREATE EXTENSION CVE-2020-25694 — postgresql: Reconnection can downgrade connection security settings CVE-2020-25695 — postgresql: Multiple features escape "security restricted operation" sandbox CVE-2020-25696 — postgresql: psql's \gset allows overwriting specially treated variables

🎯 Affected products44

  • Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-0:9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-0:9.6.20-1.module+el8.0.0+9157+356b8def.src (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-0:9.6.20-1.module+el8.0.0+9157+356b8def.x86_64 (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-contrib-0:9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-contrib-0:9.6.20-1.module+el8.0.0+9157+356b8def.x86_64 (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-contrib-debuginfo-0:9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-contrib-debuginfo-0:9.6.20-1.module+el8.0.0+9157+356b8def.x86_64 (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-debuginfo-0:9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-debuginfo-0:9.6.20-1.module+el8.0.0+9157+356b8def.x86_64 (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-debugsource-0:9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-debugsource-0:9.6.20-1.module+el8.0.0+9157+356b8def.x86_64 (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-docs-0:9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-docs-0:9.6.20-1.module+el8.0.0+9157+356b8def.x86_64 (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-docs-debuginfo-0:9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-docs-debuginfo-0:9.6.20-1.module+el8.0.0+9157+356b8def.x86_64 (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-plperl-0:9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-plperl-0:9.6.20-1.module+el8.0.0+9157+356b8def.x86_64 (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-plperl-debuginfo-0:9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-plperl-debuginfo-0:9.6.20-1.module+el8.0.0+9157+356b8def.x86_64 (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-plpython3-0:9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-plpython3-0:9.6.20-1.module+el8.0.0+9157+356b8def.x86_64 (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-plpython3-debuginfo-0:9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-plpython3-debuginfo-0:9.6.20-1.module+el8.0.0+9157+356b8def.x86_64 (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-pltcl-0:9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-pltcl-0:9.6.20-1.module+el8.0.0+9157+356b8def.x86_64 (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-pltcl-debuginfo-0:9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-pltcl-debuginfo-0:9.6.20-1.module+el8.0.0+9157+356b8def.x86_64 (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-server-0:9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • postgresql-server-0:9.6.20-1.module+el8.0.0+9157+356b8def.x86_64 (postgresql:9.6) as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)
  • +14 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. Workaround: If your use case requires SECURITY DEFINER functions, please follow the advice below to write them safely so they do not rely on search_path and restrict the set of users which can access them. https://www.postgresql.org/docs/devel/sql-createfunction.html#SQL-CREATEFUNCTION-SECURITY Workaround: While promptly updating PostgreSQL is the best remediation for most users, a user unable to do that can work around the vulnerability by disabling autovacuum and not manually running ANALYZE, CLUSTER, REINDEX, CREATE INDEX, VACUUM FULL, REFRESH MATERIALIZED VIEW, or a restore from output of the pg_dump command. Performance may degrade quickly under this workaround. Workaround: Using \gset with a prefix not found among specially treated variables, e.g. any lowercase string, precludes the attack in an unpatched psql.

🔗 References (10)