PostgreSQL Security Vulnerabilities
November 16, 2024
You can find more detailed information about a security vulnerability by clicking on the links in the table below.
Known PostgreSQL Security Vulnerabilities in Supported Versions
You can filter the view of patches to show just patches for version:
17 – 16 – 15 – 14 – 13 – all
| Reference | Affected | Fixed | Component & CVSS v3 Base Score | Description |
|---|---|---|---|---|
| CVE-2024-10979 Announcement |
17, 16, 15, 14, 13 | 17.1, 16.5, 15.9, 14.14, 13.17 | core server 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
PostgreSQL PL/Perl environment variable changes execute arbitrary code |
| CVE-2024-10978 Announcement |
17, 16, 15, 14, 13 | 17.1, 16.5, 15.9, 14.14, 13.17 | core server 4.2 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID |
| CVE-2024-10977 Announcement |
17, 16, 15, 14, 13 | 17.1, 16.5, 15.9, 14.14, 13.17 | client 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N |
PostgreSQL libpq retains an error message from man-in-the-middle |
| CVE-2024-10976 Announcement |
17, 16, 15, 14, 13 | 17.1, 16.5, 15.9, 14.14, 13.17 | core server 4.2 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
PostgreSQL row security below e.g. subqueries disregards user ID changes |
| CVE-2024-7348 Announcement |
16, 15, 14, 13 | 16.4, 15.8, 14.13, 13.16 | core server 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
PostgreSQL relation replacement during pg_dump executes arbitrary SQL |
| CVE-2024-4317 Announcement |
16, 15, 14 | 16.3, 15.7, 14.12 | core server 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
Restrict visibility of “pg_stats_ext” and “pg_stats_ext_exprs” entries to the table owner |
| CVE-2024-0985 Announcement |
16, 15, 14, 13 | 16.2, 15.6, 14.11, 13.14 | core server 8.0 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL |
| CVE-2023-39418 Announcement |
15 | 15.4 | core server 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
MERGE fails to enforce UPDATE or SELECT row security policies |
| CVE-2023-39417 Announcement |
15, 14, 13 | 15.4, 14.9, 13.12 | core server 7.5 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Extension script @substitutions@ within quoting allow SQL injection |
| CVE-2023-5870 Announcement |
16, 15, 14, 13 | 16.1, 15.5, 14.10, 13.13 | core server 2.2 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L |
Role “pg_signal_backend” can signal certain superuser processes |
| CVE-2023-5869 Announcement |
16, 15, 14, 13 | 16.1, 15.5, 14.10, 13.13 | core server 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Buffer overrun from integer overflow in array modification |
| CVE-2023-5868 Announcement |
16, 15, 14, 13 | 16.1, 15.5, 14.10, 13.13 | core server 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Memory disclosure in aggregate function calls |
| CVE-2023-2455 Announcement |
15, 14, 13 | 15.3, 14.8, 13.11 | core server 4.2 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
Row security policies disregard user ID changes after inlining |
| CVE-2023-2454 Announcement |
15, 14, 13 | 15.3, 14.8, 13.11 | core server 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
CREATE SCHEMA … schema_element defeats protective search_path changes |
| CVE-2022-41862 Announcement |
15, 14, 13 | 15.2, 14.7, 13.10 | client 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
Client memory disclosure when connecting, with Kerberos, to modified server |
| CVE-2022-2625 Announcement |
14, 13 | 14.5, 13.8 | core server 7.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
Extension scripts replace objects not belonging to the extension |
| CVE-2022-1552 Announcement |
14, 13 | 14.3, 13.7 | core server 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Autovacuum, REINDEX, and others omit “security restricted operation” sandbox |
| CVE-2021-32029 Announcement |
13 | 13.3 | core server 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Memory disclosure in partitioned-table UPDATE … RETURNING |
| CVE-2021-32028 Announcement |
13 | 13.3 | core server 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Memory disclosure in INSERT … ON CONFLICT … DO UPDATE |
| CVE-2021-32027 Announcement |
13 | 13.3 | core server 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Buffer overrun from integer overflow in array subscripting calculations |
| CVE-2021-23222 Announcement |
14, 13 | 14.1, 13.5 | client 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
libpq processes unencrypted bytes from man-in-the-middle |
| CVE-2021-23214 Announcement |
14, 13 | 14.1, 13.5 | core server 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Server processes unencrypted bytes from man-in-the-middle |
| CVE-2021-20229 Announcement |
13 | 13.2 | core server 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
Single-column SELECT privilege enables reading all columns |
| CVE-2021-3677 Announcement |
13 | 13.4 | core server 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Memory disclosure in certain queries |
| CVE-2021-3393 Announcement |
13 | 13.2 | core server 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
Partition constraint violation errors leak values of denied columns |
| CVE-2020-25696 Announcement |
13 | 13.1 | client 7.5 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
psql’s \gset allows overwriting specially treated variables |
| CVE-2020-25695 Announcement |
13 | 13.1 | core server 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Multiple features escape “security restricted operation” sandbox |
| CVE-2020-25694 Announcement |
13 | 13.1 | client 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Reconnection can downgrade connection security settings |
