{"id":"CVE-2020-14349","year":2020,"sequence":14349,"component":"core server","score":7.5,"cvss_version":"3.0","vector":"AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","first_published":"2020-08-13","source_url":"https://www.postgresql.org/support/security/CVE-2020-14349/","facts":{"affected":{"10":"10","11":"11","12":"12"},"component":"core server","cvss_version":"3.0","description_en":"The PostgreSQL search_path setting determines schemas searched for tables, functions, operators, etc. The CVE-2018-1058 fix caused most PostgreSQL-provided client applications to sanitize search_path , but logical replication continued to leave search_path unchanged. Users of a replication publisher or subscriber database can create objects in the public schema and harness them to execute arbitrary SQL functions under the identity running replication, often a superuser. Installations having adopted a documented secure schema usage pattern are not vulnerable.\n\nThe PostgreSQL project thanks Noah Misch for reporting this problem.","first_published":"2020-08-13","fixed":{"10":"10.14","11":"11.9","12":"12.4"},"id":"CVE-2020-14349","introduced":{},"published":{"10":"2020-08-13","11":"2020-08-13","12":"2020-08-13"},"score":7.5,"title":"Uncontrolled search path element in logical replication","url":"https://www.postgresql.org/support/security/CVE-2020-14349/","vector":"AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},"reviewed_hash":"6a65a7884245936f6adaef8709d290d460e999dfce1ad78734fa7c9a324ed325","source_hash":"965b9e2323feab543f3cbeb74c418c3a5b43cbefc6594d2862ff0d24dcf8e6a2","text":null,"locales":["en"],"fixes":[{"major":"10","fixed_version":"10.14","introduced":null,"published_date":"2020-08-13","facts":{"fixed":"10.14","introduced":null,"published":"2020-08-13"}},{"major":"11","fixed_version":"11.9","introduced":null,"published_date":"2020-08-13","facts":{"fixed":"11.9","introduced":null,"published":"2020-08-13"}},{"major":"12","fixed_version":"12.4","introduced":null,"published_date":"2020-08-13","facts":{"fixed":"12.4","introduced":null,"published":"2020-08-13"}}],"legacy":[]}