CVE-2020-14350 Untrusted Search Path in PostgreSQL
Attackers can execute arbitrary code with administrator privileges by exploiting unsafe search_path usage in PostgreSQL extension installation scripts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-14350?
CVE-2020-14350 is a high-severity code injection vulnerability in Canonical Ubuntu Linux, published on 24 Aug 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.
Weakness: CWE-426
Which versions are affected by CVE-2020-14350?
2 open source packages ship an affected version, including postgresql and org.postgresql:postgresql. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | From 9.5.0 | 9.5.23, 9.6.19, 10.14.0, 11.9.0, 12.4.0 |
org.postgresql:postgresql Maven | All versions | 12.4 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Opensuse Leap, Postgresql Postgresql.
How do I fix CVE-2020-14350?
Upgrade postgresql to a fixed version for your release line: 9.5.23, 9.6.19, 10.14.0 or 11.9.0.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-14350 being exploited?
There is no known exploitation of CVE-2020-14350 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2020-14350, BIT-postgresql-2020-14350, CLEANSTART-2026-TS16733, DLA-2331-1, GHSA-6v9v-3f4c-cjgx, JLSEC-2026-25 and 1 more.