Improper authorization in Red Hat postgresql
Priority LOW 31CWE-285Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-285.
Summary
A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.
Why it matters now
EPSS 0.01183 67th percentileScored 2026-11-07
Fix Fixed Red Hat: 12 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | postgresql | 12.2; 11.7; 10.12; 9.6.17 | — | No fix listed | CNA |
- postgresql VendorRed Hat Affected 12.2; 11.7; 10.12; 9.6.17 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* | 9.6 to before 9.6.17; 10.0 to before 10.12; 11.0 to before 11.7; 12.0 to before 12.2 | Vulnerable | PostgreSQL |
| cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
- cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions 9.6 to before 9.6.17; 10.0 to before 10.12; 11.0 to before 11.7; 12.0 to before 12.2 Vulnerable ·PostgreSQL
- cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
Remediation
Red Hat 12 advisories
- RHSA-2021:0167 Released 2021-01-18 · Red Hat rating Importantpostgresql:9.6 security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) postgresql-9.6.20-1.module+el8.1.0+9156+8ff1384f.aarch64::postgresql:9.6, postgresql-9.6.20-1.module+el8.1.0+9156+8ff1384f.ppc64le::postgresql:9.6, postgresql-9.6.20-1.module+el8.1.0+9156+8ff1384f.s390x::postgresql:9.6 +42
- RHSA-2021:0166 Released 2021-01-18 · Red Hat rating Importantpostgresql:10 security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) postgresql-10.15-1.module+el8.1.0+9154+cd474635.aarch64::postgresql:10, postgresql-10.15-1.module+el8.1.0+9154+cd474635.ppc64le::postgresql:10, postgresql-10.15-1.module+el8.1.0+9154+cd474635.s390x::postgresql:10 +47
- RHSA-2021:0164 Released 2021-01-18 · Red Hat rating Importantpostgresql:9.6 security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) postgresql-9.6.20-1.module+el8.2.0+8939+9a3b4b64.aarch64::postgresql:9.6, postgresql-9.6.20-1.module+el8.2.0+8939+9a3b4b64.ppc64le::postgresql:9.6, postgresql-9.6.20-1.module+el8.2.0+8939+9a3b4b64.s390x::postgresql:9.6 +42
Show 9 more Red Hat advisories
- RHSA-2021:0163 Released 2021-01-18 · Red Hat rating Importantpostgresql:12 security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.aarch64::postgresql:12, pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.ppc64le::postgresql:12, pgaudit-1.4.0-4.module+el8.2.0+9043+1dbb5661.s390x::postgresql:12 +47
- RHSA-2020:5664 Released 2020-12-22 · Red Hat rating Importantpostgresql:10 security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.0) postgresql-10.15-1.module+el8.0.0+9155+4a85661a.ppc64le::postgresql:10, postgresql-10.15-1.module+el8.0.0+9155+4a85661a.src::postgresql:10, postgresql-10.15-1.module+el8.0.0+9155+4a85661a.x86_64::postgresql:10 +24
- RHSA-2020:5661 Released 2020-12-22 · Red Hat rating Importantpostgresql:9.6 security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.0) postgresql-9.6.20-1.module+el8.0.0+9157+356b8def.ppc64le::postgresql:9.6, postgresql-9.6.20-1.module+el8.0.0+9157+356b8def.src::postgresql:9.6, postgresql-9.6.20-1.module+el8.0.0+9157+356b8def.x86_64::postgresql:9.6 +20
- RHSA-2020:5620 Released 2020-12-17 · Red Hat rating Importantpostgresql:12 security update
- Red Hat Enterprise Linux AppStream (v. 8) pgaudit-1.4.0-4.module+el8.3.0+9042+664538f4.aarch64::postgresql:12, pgaudit-1.4.0-4.module+el8.3.0+9042+664538f4.ppc64le::postgresql:12, pgaudit-1.4.0-4.module+el8.3.0+9042+664538f4.s390x::postgresql:12 +47
- RHSA-2020:5619 Released 2020-12-17 · Red Hat rating Importantpostgresql:9.6 security update
- Red Hat Enterprise Linux AppStream (v. 8) postgresql-9.6.20-1.module+el8.3.0+8938+7f0e88b6.aarch64::postgresql:9.6, postgresql-9.6.20-1.module+el8.3.0+8938+7f0e88b6.ppc64le::postgresql:9.6, postgresql-9.6.20-1.module+el8.3.0+8938+7f0e88b6.s390x::postgresql:9.6 +42
- RHSA-2020:5112 Released 2020-11-16 · Red Hat rating Moderaterh-postgresql12-postgresql security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-postgresql12-postgresql-12.4-1.el7, rh-postgresql12-postgresql-contrib-12.4-1.el7, rh-postgresql12-postgresql-contrib-syspaths-12.4-1.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-postgresql12-postgresql-12.4-1.el7, rh-postgresql12-postgresql-contrib-12.4-1.el7, rh-postgresql12-postgresql-contrib-syspaths-12.4-1.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-postgresql12-postgresql-12.4-1.el7, rh-postgresql12-postgresql-contrib-12.4-1.el7, rh-postgresql12-postgresql-contrib-syspaths-12.4-1.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-postgresql12-postgresql-12.4-1.el7, rh-postgresql12-postgresql-contrib-12.4-1.el7, rh-postgresql12-postgresql-contrib-syspaths-12.4-1.el7 +11
- RHSA-2020:4295 Released 2020-10-21 · Red Hat rating Moderaterh-postgresql96-postgresql security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-postgresql96-postgresql-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.19-1.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-postgresql96-postgresql-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.19-1.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-postgresql96-postgresql-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.19-1.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-postgresql96-postgresql-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.19-1.el7 +11
- RHSA-2020:3669 Released 2020-09-08 · Red Hat rating Moderatepostgresql:10 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) postgresql-10.14-1.module+el8.2.0+7801+be0fed80.aarch64::postgresql:10, postgresql-10.14-1.module+el8.2.0+7801+be0fed80.ppc64le::postgresql:10, postgresql-10.14-1.module+el8.2.0+7801+be0fed80.s390x::postgresql:10 +47
- RHSA-2020:0980 Released 2020-03-26 · Red Hat rating Moderaterh-postgresql10-postgresql security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-postgresql10-postgresql-10.12-2.el7, rh-postgresql10-postgresql-contrib-10.12-2.el7, rh-postgresql10-postgresql-contrib-syspaths-10.12-2.el7 +11
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| RHV-M 4.3 | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:3669, RHSA-2020:5619, RHSA-2020:5620 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.0) | Fixed | RHSA-2020:5661, RHSA-2020:5664 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.1) | Fixed | RHSA-2021:0166, RHSA-2021:0167 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.2) | Fixed | RHSA-2021:0163, RHSA-2021:0164 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:0980, RHSA-2020:4295, RHSA-2020:5112 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) | Fixed | RHSA-2020:0980 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2020:0980, RHSA-2020:4295, RHSA-2020:5112 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2020:0980, RHSA-2020:4295, RHSA-2020:5112 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:0980, RHSA-2020:4295, RHSA-2020:5112 |
Not affected: 7 products
- Red Hat Decision Manager 7
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Process Automation 7
- Red Hat Satellite 5
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1720
- 2026-10-03 Alias added: GHSA-prcp-93mm-93fm
References
More Red Hat Decision Manager vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2019-11045 Insufficiently protected credentials in Business-central CVSS 3.1HIGH 7.5
- TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2018-13721 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
- TI-2018-13720 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
- TI-2018-13719 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2020-1720 · CVE Program
- CVE-2020-1720 · NVD
- FIRST EPSS
- GHSA-prcp-93mm-93fm · GitHub Advisory Database · CC BY 4.0
- CVE-2020-1720 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences