Vulnerabilities

PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence.

PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions.

PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies.

PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule.

PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view.

PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables.

PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed.

PostgreSQL restricts acces to the salt and shift via the `SHOW` command for users not member of `pg_read_all_settings`.

PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table.

PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared dimension of the provided image, allowing an attacker to provide a small image with enormous declared dimensions.

PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size.

PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles.

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce…

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arbitrary code with superuser privilege.

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions.

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions.

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce…

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a particular key-value pair.

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a table and placing malicious code inside a column identifier.

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing malicious code.

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator.

PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data using a database cursor or the --insert option of pg_dump.

PostgreSQL Anonymizer v1.2 contains a vulnerability that allows a user who owns a table to elevate to superuser.

PostgreSQL Anonymizer v1.2 contains a SQL injection vulnerability that allows a user who owns a table to elevate to superuser when dynamic masking is enabled.