CVE-2022-2625

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

• postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

• postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

• postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625)

• postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

• postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

• postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

• postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625)
• postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

• postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625)
• postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

• CVE-2026-14669: to_char(): bound TZ/tz timezone abbreviation length to prevent a heap buffer overrun in DCH_to_char()
• CVE-2022-2625: extensions: forbid CREATE OR REPLACE and CREATE ... IF NOT EXISTS from absorbing free-standing objects

• CVE-2026-14669: to_char(): bound TZ/tz timezone abbreviation length to prevent a heap buffer overrun in DCH_to_char()
• CVE-2022-2625: extensions: forbid CREATE OR REPLACE and CREATE ... IF NOT EXISTS from absorbing free-standing objects

• CVE-2026-14669: to_char(): bound TZ/tz timezone abbreviation length to prevent a heap buffer overrun in DCH_to_char()
• CVE-2022-2625: extensions: forbid CREATE OR REPLACE and CREATE ... IF NOT EXISTS from absorbing free-standing objects

Autovacuum, REINDEX, and others omit "security restricted operation" sandbox (CVE-2022-1552) Extension scripts replace objects not belonging to the extension (CVE-2022-2625)

These are all security issues fixed in the postgresql10-10.22-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql11-11.17-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql12-12.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql13-13.8-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libecpg6-14.5-1.1 package on the GA media of openSUSE Tumbleweed.

This update for postgresql10 fixes the following issues:

• Upgrade to 10.22:

• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

• Upgrade to 10.21:

• CVE-2022-1552: Confined additional operations within 'security restricted operation' sandboxes (bsc#1199475).

• Upgrade to 10.20 (bsc#1195680)

• Add constraints file with 12GB of memory for s390x as a workaround (boo#1190740)

• Upgrade to version 10.19 (bsc#1192516):

• CVE-2021-23214: Made the server reject extraneous data after an SSL or GSS encryption handshake

• CVE-2021-23222: Made libpq reject extraneous data after an SSL or GSS encryption handshake

• Fix for build with llvm12 on s390x. (bsc#1185952)

• Re-enable 'icu' for PostgreSQL 10. (bsc#1179945)

• Add postgresqlXX-server-devel as a dependency for postgresql13-server-devel. (bsc#1187751)

• Upgrade to version 10.18. (bsc#1190177)

This update for postgresql13 fixes the following issues:

• Update to 13.8:
• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

This update for postgresql10 fixes the following issues:

• Upgrade to 10.22:
• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

This update for postgresql10 fixes the following issues:

• Upgrade to 10.22:
• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

This update for postgresql12 fixes the following issues:

• Upgrade to 12.12:

• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

• Upgrade to 12.11:

• CVE-2022-1552: Confined additional operations within 'security restricted operation' sandboxes (bsc#1199475).

• Upgrade to 12.10 (bsc#1195680)

• Add constraints file with 12GB of memory for s390x as a workaround (boo#1190740)

• Upgrade to version 12.9 (bsc#1192516):

• CVE-2021-23214: Made the server reject extraneous data after an SSL or GSS encryption handshake

• CVE-2021-23222: Made libpq reject extraneous data after an SSL or GSS encryption handshake

• Upgrade to version 12.8:

• CVE-2021-3677: Fixed memory disclosure in certain queries (bsc#1189748).

• Upgrade to version 12.7:

• CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924).

• CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925).

• CVE-2021-32029: Fixed possibly-incorrect computation of UPDATE ... RETURNING 'pg_psql_temporary_savepoint' does not exist (bsc#1185926).

• Fixed build with llvm12 on s390x (bsc#1185952).

• Re-enabled icu for PostgreSQL 10 (bsc#1179945).

• Made the dependency of postgresqlXX-server-devel on llvm and clang optional (bsc#1187751).

• llvm12 breaks PostgreSQL 11 and 12 on s390x. Use llvm11 as a workaround (bsc#1185952).

• Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168).

This update for postgresql13 fixes the following issues:

• Update to 13.8:
• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

This update for postgresql12 fixes the following issues:

• Update to 12.12:
• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

This update for postgresql14 fixes the following issues:

• Upgrade to version 14.5:

• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

• Upgrade to version 14.4 (bsc#1200437)

• Release notes: https://www.postgresql.org/docs/release/14.4/

• Release announcement: https://www.postgresql.org/about/news/p-2470/

• Prevent possible corruption of indexes created or rebuilt with the CONCURRENTLY option (bsc#1200437)

• Pin to llvm13 until the next patchlevel update (bsc#1198166)

This update for postgresql14 fixes the following issues:

• Upgrade to version 14.5:

• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

• Upgrade to version 14.4 (bsc#1200437)

• Release notes: https://www.postgresql.org/docs/release/14.4/

• Release announcement: https://www.postgresql.org/about/news/p-2470/

• Prevent possible corruption of indexes created or rebuilt with the CONCURRENTLY option (bsc#1200437)

• Pin to llvm13 until the next patchlevel update (bsc#1198166)

This update for postgresql12 fixes the following issues:

• Update to 12.12:
• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

This update for postgresql14 fixes the following issues:

• Upgrade to version 14.5:

• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

• Upgrade to version 14.4 (bsc#1200437)

• Release notes: https://www.postgresql.org/docs/release/14.4/

• Release announcement: https://www.postgresql.org/about/news/p-2470/

• Prevent possible corruption of indexes created or rebuilt with the CONCURRENTLY option (bsc#1200437)

• Pin to llvm13 until the next patchlevel update (bsc#1198166)

Sven Klemm discovered that PostgreSQL incorrectly handled extensions. An attacker could possibly use this issue to execute arbitrary code when extensions are created or updated.