Vulnerability Description
A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Postgresql | Postgresql | >= 10.0, < 10.22 |
| Fedoraproject | Fedora | 36 |
| Redhat | Enterprise Linux | 6.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2113825Issue TrackingThird Party Advisory
- https://security.gentoo.org/glsa/202211-04Third Party Advisory
- https://www.postgresql.org/about/news/postgresql-145-138-1212-1117-1022-and-15-bRelease NotesVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2113825Issue TrackingThird Party Advisory
- https://security.gentoo.org/glsa/202211-04Third Party Advisory
- https://www.postgresql.org/about/news/postgresql-145-138-1212-1117-1022-and-15-bRelease NotesVendor Advisory
FAQ
What is CVE-2022-2625?
CVE-2022-2625 is a vulnerability with a CVSS score of 8.0 (HIGH). A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an...
How severe is CVE-2022-2625?
CVE-2022-2625 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-2625?
Check the references section above for vendor advisories and patch information. Affected products include: Postgresql Postgresql, Fedoraproject Fedora, Redhat Enterprise Linux.