<p>Upgrade <code>Alpine:3.9</code> <code>postgresql</code> to version 11.7-r0 or higher.</p>

Missing Authorization Affecting postgresql package, versions <11.7-r0

Snyk CVSS

Attack Complexity Low

Integrity High

Threat Intelligence

EPSS 0.07% (28^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-ALPINE39-POSTGRESQL-587907
published 21 Jul 2020
disclosed 17 Mar 2020

Report a new vulnerability Found a mistake?

Introduced: 17 Mar 2020

CVE-2020-1720 Open this link in a new tab CWE-862 Open this link in a new tab CWE-285 Open this link in a new tab

How to fix?

Upgrade Alpine:3.9 postgresql to version 11.7-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream postgresql package and not the postgresql package as distributed by Alpine. See How to fix? for Alpine:3.9 relevant fixed versions and status.

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.