Vulnerability · Published Aug 18, 2022 · Assigned by redhat
CVE-2022-2625
High 8.0
In plain English
A high-severity security flaw in postgresql. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.0High
Exploit odds (30 days)2.2%top 17.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | pg_repack | 1.4.6-3.module_el8.6.0+3095+ee60d910 | ALSA-2023:1576 |
| AlmaLinux:8 | pg_repack | 1.4.6-3.module_el8.6.0+3095+ee60d910 | ALSA-2022:7128 |
| AlmaLinux:8 | pg_repack | 1.4.6-3.module_el8.6.0+2760+1746ec94 | ALSA-2022:7128 |
| AlmaLinux:8 | pg_repack | 1.4.6-3.module_el8.6.0+2760+1746ec94 | ALSA-2023:1576 |
| AlmaLinux:8 | pgaudit | 1.5.0-1.module_el8.6.0+2760+1746ec94 | ALSA-2023:1576 |
| AlmaLinux:8 | pgaudit | 1.4.0-5.module_el8.6.0+2758+4f4474df | ALSA-2022:7128 |
| AlmaLinux:8 | pgaudit | 1.4.0-5.module_el8.6.0+3094+eb237fb8 | ALSA-2022:7128 |
| AlmaLinux:8 | pgaudit | 1.5.0-1.module_el8.6.0+3095+ee60d910 | ALSA-2023:1576 |
| AlmaLinux:8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+3095+ee60d910 | ALSA-2023:1576 |
| AlmaLinux:8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+2760+1746ec94 | ALSA-2023:1576 |
| AlmaLinux:8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+2760+1746ec94 | ALSA-2022:7128 |
| AlmaLinux:8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+3095+ee60d910 | ALSA-2022:7128 |
| AlmaLinux:8 | postgresql | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql | 10.23-1.module_el8.7.0+3379+54d21c26 | ALSA-2023:0113 |
| AlmaLinux:8 | postgresql | 12.12-1.module_el8.6.0+3336+e779e518 | ALSA-2022:7128 |
| AlmaLinux:9 | postgresql | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-contrib | 12.12-1.module_el8.6.0+3336+e779e518 | ALSA-2022:7128 |
| AlmaLinux:8 | postgresql-contrib | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-contrib | 10.23-1.module_el8.7.0+3379+54d21c26 | ALSA-2023:0113 |
| AlmaLinux:9 | postgresql-contrib | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-docs | 12.12-1.module_el8.6.0+3336+e779e518 | ALSA-2022:7128 |
| AlmaLinux:8 | postgresql-docs | 10.23-1.module_el8.7.0+3379+54d21c26 | ALSA-2023:0113 |
| AlmaLinux:8 | postgresql-docs | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:9 | postgresql-docs | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-plperl | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-plperl | 12.12-1.module_el8.6.0+3336+e779e518 | ALSA-2022:7128 |
| AlmaLinux:8 | postgresql-plperl | 10.23-1.module_el8.7.0+3379+54d21c26 | ALSA-2023:0113 |
| AlmaLinux:9 | postgresql-plperl | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-plpython3 | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-plpython3 | 10.23-1.module_el8.7.0+3379+54d21c26 | ALSA-2023:0113 |
| AlmaLinux:8 | postgresql-plpython3 | 12.12-1.module_el8.6.0+3336+e779e518 | ALSA-2022:7128 |
| AlmaLinux:9 | postgresql-plpython3 | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-pltcl | 10.23-1.module_el8.7.0+3379+54d21c26 | ALSA-2023:0113 |
| AlmaLinux:8 | postgresql-pltcl | 12.12-1.module_el8.6.0+3336+e779e518 | ALSA-2022:7128 |
| AlmaLinux:8 | postgresql-pltcl | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:9 | postgresql-pltcl | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:9 | postgresql-private-devel | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:9 | postgresql-private-libs | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-server | 12.12-1.module_el8.6.0+3336+e779e518 | ALSA-2022:7128 |
| AlmaLinux:8 | postgresql-server | 10.23-1.module_el8.7.0+3379+54d21c26 | ALSA-2023:0113 |
| AlmaLinux:8 | postgresql-server | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:9 | postgresql-server | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-server-devel | 12.12-1.module_el8.6.0+3336+e779e518 | ALSA-2022:7128 |
| AlmaLinux:8 | postgresql-server-devel | 10.23-1.module_el8.7.0+3379+54d21c26 | ALSA-2023:0113 |
| AlmaLinux:8 | postgresql-server-devel | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:9 | postgresql-server-devel | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-static | 10.23-1.module_el8.7.0+3379+54d21c26 | ALSA-2023:0113 |
| AlmaLinux:8 | postgresql-static | 12.12-1.module_el8.6.0+3336+e779e518 | ALSA-2022:7128 |
| AlmaLinux:8 | postgresql-static | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:9 | postgresql-static | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-test | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-test | 10.23-1.module_el8.7.0+3379+54d21c26 | ALSA-2023:0113 |
| AlmaLinux:8 | postgresql-test | 12.12-1.module_el8.6.0+3336+e779e518 | ALSA-2022:7128 |
| AlmaLinux:9 | postgresql-test | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-test-rpm-macros | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-test-rpm-macros | 12.12-1.module_el8.6.0+3336+e779e518 | ALSA-2022:7128 |
| AlmaLinux:8 | postgresql-test-rpm-macros | 10.23-1.module_el8.7.0+3379+54d21c26 | ALSA-2023:0113 |
| AlmaLinux:8 | postgresql-upgrade | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-upgrade | 12.12-1.module_el8.6.0+3336+e779e518 | ALSA-2022:7128 |
| AlmaLinux:8 | postgresql-upgrade | 10.23-1.module_el8.7.0+3379+54d21c26 | ALSA-2023:0113 |
| AlmaLinux:9 | postgresql-upgrade | 13.10-1.el9_1 | ALSA-2023:1693 |
| AlmaLinux:8 | postgresql-upgrade-devel | 12.12-1.module_el8.6.0+3336+e779e518 | ALSA-2022:7128 |
| AlmaLinux:8 | postgresql-upgrade-devel | 13.10-1.module_el8.7.0+3498+cb1ef3c6 | ALSA-2023:1576 |
| AlmaLinux:8 | postgresql-upgrade-devel | 10.23-1.module_el8.7.0+3379+54d21c26 | ALSA-2023:0113 |
| AlmaLinux:9 | postgresql-upgrade-devel | 13.10-1.el9_1 | ALSA-2023:1693 |
| Alpine:v3.20 | postgresql14 | 14.5-r0 | ALPINE-CVE-2022-2625 |
| Alpine:v3.20 | postgresql15 | 14.5-r0 | ALPINE-CVE-2022-2625 |
| Rocky Linux:8 | pg_repack | 0:1.4.6-3.module+el8.5.0+684+c3892ef9 | RLSA-2022:7128 |
| Rocky Linux:8 | pg_repack | 0:1.4.6-3.module+el8.5.0+684+c3892ef9 | RLSA-2023:1576 |
| Rocky Linux:8 | pgaudit | 0:1.4.0-5.module+el8.5.0+686+20453ecc | RLSA-2022:7128 |
| Rocky Linux:8 | pgaudit | 0:1.5.0-1.module+el8.5.0+684+c3892ef9 | RLSA-2023:1576 |
| Rocky Linux:8 | postgres-decoderbufs | 0:0.10.0-2.module+el8.4.0+424+71d47d9a | RLSA-2022:7128 |
| Rocky Linux:8 | postgres-decoderbufs | 0:0.10.0-2.module+el8.5.0+684+c3892ef9 | RLSA-2022:7128 |
| Rocky Linux:8 | postgres-decoderbufs | 0:0.10.0-2.module+el8.5.0+684+c3892ef9 | RLSA-2023:1576 |
| Rocky Linux:8 | postgresql | 0:13.10-1.module+el8.7.0+1175+026203e7 | RLSA-2023:1576 |
| Rocky Linux:8 | postgresql | 0:10.23-1.module+el8.7.0+1118+c6c6f44a | RLSA-2023:0113 |
| Rocky Linux:8 | postgresql | 0:12.12-1.module+el8.6.0+1049+f8fc4c36 | RLSA-2022:7128 |
| Ubuntu:22.04:LTS | postgresql-14 | 14.5-0ubuntu0.22.04.1 | USN-5571-1 |
| Ubuntu:22.04:LTS | postgresql-14 | 14.5-0ubuntu0.22.04.1 | UBUNTU-CVE-2022-2625 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | postgresql | postgresql 14.5, postgresql 13.8, postgresql 12.12, postgresql 11.17, postgresql 10.22 |
Weakness: CWE-915