CVE-2020-14350 – This CVE describes a PostgreSQL vulnerability w... (How to Fix)

Q: What is the severity of CVE-2020-14350?

CVE-2020-14350 has a CVSS score of 7.3 (HIGH). This CVE describes a PostgreSQL vulnerability where certain extensions don't properly secure their installation scripts against search_path manipulation. Attackers with sufficient database privileges can trick administrators into executing malicious scripts during extension installation or updates. This affects PostgreSQL versions before specific security releases.

📋 TL;DR

This CVE describes a PostgreSQL vulnerability where certain extensions don't properly secure their installation scripts against search_path manipulation. Attackers with sufficient database privileges can trick administrators into executing malicious scripts during extension installation or updates. This affects PostgreSQL versions before specific security releases.

💻 Affected Systems

Products:

PostgreSQL

Versions: Versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23

Operating Systems: All operating systems running affected PostgreSQL versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems where PostgreSQL extensions are being installed or updated by administrators. Requires attacker to have sufficient database privileges to influence the installation process.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

An attacker could execute arbitrary code with database administrator privileges, potentially leading to full database compromise, data exfiltration, or lateral movement to the underlying operating system.

🟠

Likely Case

Privileged database users could escalate privileges, manipulate data, or install backdoors within the PostgreSQL environment.

🟢

If Mitigated

With proper access controls and monitoring, impact is limited to the database layer with no operating system compromise.

🌐 Internet-Facing: MEDIUM - While exploitation requires database privileges, internet-facing PostgreSQL instances with weak authentication could be vulnerable.

🏢 Internal Only: MEDIUM - Internal attackers with database access could exploit this, but requires specific conditions during extension management.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires: 1) Attacker with CREATE privilege or higher, 2) Administrator installing/updating vulnerable extensions, 3) Ability to influence search_path during installation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: PostgreSQL 12.4, 11.9, 10.14, 9.6.19, 9.5.23

Vendor Advisory: https://www.postgresql.org/support/security/

Restart Required: Yes

Instructions:

1. Backup your PostgreSQL database. 2. Stop PostgreSQL service. 3. Upgrade to patched version using your distribution's package manager or PostgreSQL binaries. 4. Restart PostgreSQL service. 5. Verify upgrade completed successfully.

🔧 Temporary Workarounds

Restrict extension installation

all

Limit who can install PostgreSQL extensions and monitor extension installation activities

REVOKE CREATE ON SCHEMA public FROM PUBLIC;
CREATE ROLE extension_installer;
GRANT CREATE ON SCHEMA public TO extension_installer;

Secure search_path for administrators

all

Set secure search_path for database administrators during extension operations

ALTER ROLE admin_user SET search_path = "\"$user\", public";

🧯 If You Can't Patch

Implement strict access controls: Only allow trusted administrators to install/update extensions
Monitor and audit all extension installation activities and review installation scripts before execution

🔍 How to Verify

Check if Vulnerable:

Check PostgreSQL version: SELECT version(); If version is earlier than patched versions listed above, system is vulnerable.

Check Version:

psql -c 'SELECT version();'

Verify Fix Applied:

After patching, verify version shows patched release and test extension installation procedures.

📡 Detection & Monitoring

Log Indicators:

Unusual extension installation activities
Multiple failed extension installation attempts
Administrator account performing unexpected CREATE operations

Network Indicators:

Unusual database connection patterns during maintenance windows

SIEM Query:

source="postgresql.log" AND ("CREATE EXTENSION" OR "ALTER EXTENSION") AND NOT user IN (allowed_admin_users)

📊 Metadata

CVE ID: CVE-2020-14350

CVSS v3 Score: 7.3 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-426

Published: August 24, 2020

Last Updated: November 21, 2024

🔗 References

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html Mailing List,Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1865746 Issue Tracking,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00028.html Mailing List,Third Party Advisory
https://security.gentoo.org/glsa/202008-13 Third Party Advisory
https://security.netapp.com/advisory/ntap-20200918-0002/ Third Party Advisory
https://usn.ubuntu.com/4472-1/ Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html Mailing List,Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html Mailing List,Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1865746 Issue Tracking,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00028.html Mailing List,Third Party Advisory
https://security.gentoo.org/glsa/202008-13 Third Party Advisory
https://security.netapp.com/advisory/ntap-20200918-0002/ Third Party Advisory
https://usn.ubuntu.com/4472-1/ Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-14350, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Leap by Opensuse

Leap by Opensuse

Postgresql by Postgresql

Postgresql by Postgresql

Postgresql by Postgresql

Postgresql by Postgresql

Postgresql by Postgresql

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Restrict extension installation

Secure search_path for administrators

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities