CVE-2020-14350.json

{
    "CVE-ID": "CVE-2020-14350",
    "NVD": {
        "Descriptions": "It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.",
        "Cvss2_BaseScore": 4.4,
        "Cvss3_BaseScore": 7.3,
        "Cvss2_VectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
        "Cvss3_VectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
        "CPEs": [
            {
                "URI": "cpe:/o:opensuse:leap:15.2",
                "FormattedString": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "",
                "VersionEndExcluding": "",
                "VersionEndIncluding": ""
            },
            {
                "URI": "cpe:/o:opensuse:leap:15.1",
                "FormattedString": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "",
                "VersionEndExcluding": "",
                "VersionEndIncluding": ""
            },
            {
                "URI": "cpe:/o:debian:debian_linux:9.0",
                "FormattedString": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "",
                "VersionEndExcluding": "",
                "VersionEndIncluding": ""
            },
            {
                "URI": "cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~",
                "FormattedString": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "",
                "VersionEndExcluding": "",
                "VersionEndIncluding": ""
            },
            {
                "URI": "cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~",
                "FormattedString": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "",
                "VersionEndExcluding": "",
                "VersionEndIncluding": ""
            },
            {
                "URI": "cpe:/o:canonical:ubuntu_linux:16.04::~~esm~~~",
                "FormattedString": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "",
                "VersionEndExcluding": "",
                "VersionEndIncluding": ""
            },
            {
                "URI": "cpe:/a:postgresql:postgresql",
                "FormattedString": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "9.5",
                "VersionEndExcluding": "9.5.23",
                "VersionEndIncluding": ""
            },
            {
                "URI": "cpe:/a:postgresql:postgresql",
                "FormattedString": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "9.6",
                "VersionEndExcluding": "9.6.19",
                "VersionEndIncluding": ""
            },
            {
                "URI": "cpe:/a:postgresql:postgresql",
                "FormattedString": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "10.0",
                "VersionEndExcluding": "10.14",
                "VersionEndIncluding": ""
            },
            {
                "URI": "cpe:/a:postgresql:postgresql",
                "FormattedString": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "11.0",
                "VersionEndExcluding": "11.9",
                "VersionEndIncluding": ""
            },
            {
                "URI": "cpe:/a:postgresql:postgresql",
                "FormattedString": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "12.0",
                "VersionEndExcluding": "12.4",
                "VersionEndIncluding": ""
            }
        ]
    },
    "Official": {
        "9.5.23": {
            "source": [
                "https://www.postgresql.org/support/security/9.5/",
                "https://www.postgresql.org/docs/release/9.5.23/"
            ]
        },
        "9.6.19": {
            "source": [
                "https://www.postgresql.org/support/security/9.6/",
                "https://www.postgresql.org/docs/release/9.6.19/"
            ]
        },
        "10.14": {
            "source": [
                "https://www.postgresql.org/support/security/10/",
                "https://www.postgresql.org/docs/release/10.14/"
            ]
        },
        "11.9": {
            "source": [
                "https://www.postgresql.org/support/security/11/",
                "https://www.postgresql.org/docs/release/11.9/"
            ]
        },
        "12.4": {
            "source": [
                "https://www.postgresql.org/support/security/12/",
                "https://www.postgresql.org/docs/release/12.4/"
            ]
        }
    }
}