Skip to content
Fencer Vulns
high 8.0

CVE-2022-2625 json

A vulnerability was found in PostgreSQL.

published 2022-08-18 4 y ago modified 2026-11-02 6 d ago also BIT-postgresql-2022-2625 , EUVD-2022-34872 , JLSEC-2026-38

cvss
8.0
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.2%
EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

Patch / fix

  • bitnami postgresql 10.22.0, 11.17.0, 12.12.0, 13.8.0, 14.5.0
  • julia LibPQ_jll 16.0.0+0
  • postgresql postgresql 10.22, 11.17, 12.12, 13.8, 14.5
  • postgresql-13 Debian 11 13.8-0+deb11u1

debian advisories DEBIAN-CVE-2022-2625

  • postgresql-10 Ubuntu 18.04 LTS 10.22-0ubuntu0.18.04.1
  • postgresql-12 Ubuntu 20.04 LTS 12.12-0ubuntu0.20.04.1
  • postgresql-14 Ubuntu 22.04 LTS 14.5-0ubuntu0.22.04.1

ubuntu advisories UBUNTU-CVE-2022-2625

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • pgaudit RHEL 8, RHEL 8.6 EUS, RHEL 8.4 TUS +2 more 1.5.0-1.module+el8.4.0+8873+b821c30a
  • pg_repack RHEL 8, RHEL 8.6 EUS 1.4.6-3.module+el8.5.0+11357+bcc62552
  • postgres-decoderbufs RHEL 8, RHEL 8.6 EUS, RHEL 8.4 TUS +2 more 0.10.0-2.module+el8.4.0+8873+b821c30a
  • postgresql RHEL 8 13.10-1.module+el8.7.0+18279+1ca8cf12
  • postgresql-test RHEL 8 13.10-1.module+el8.7.0+18279+1ca8cf12
  • postgresql-pltcl RHEL 8 13.10-1.module+el8.7.0+18279+1ca8cf12
  • postgresql-plperl RHEL 8 13.10-1.module+el8.7.0+18279+1ca8cf12
  • postgresql-server RHEL 8 13.10-1.module+el8.7.0+18279+1ca8cf12

red hat advisories RHSA-2023:7694RHSA-2023:7667RHSA-2023:7580RHSA-2023:7695RHSA-2023:1576RHSA-2023:7545

  • postgresql14 SLES 15 SP2-BCL, SLE Module for Server Applications 15 SP4, SLE Module for Server Applications 15 SP3 +14 more 14.5-150200.5.17.1
  • postgresql14 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +6 more 14.5-3.14.9
  • postgresql12 SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 12.12-3.30.2
  • postgresql SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +6 more 14-4.17.2
  • postgresql12 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +10 more 12.12-150200.8.35.1
  • postgresql13 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +12 more 13.8-150200.5.31.1
  • postgresql12 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +3 more 12.12-150100.3.33.1
  • postgresql10 SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES 15 SP2-LTSS +15 more 10.22-150100.8.50.1

suse advisories SUSE-SU-2022:2989-2SUSE-SU-2022:3269-1SUSE-SU-2022:3193-1SUSE-SU-2022:2989-1SUSE-SU-2022:2988-1SUSE-SU-2022:2987-1

  • postgresql10 openSUSE Tumbleweed 10.22-1.1
  • postgresql11 openSUSE Tumbleweed 11.17-1.1
  • postgresql12 openSUSE Tumbleweed 12.12-1.1
  • postgresql13 openSUSE Tumbleweed 13.8-1.1
  • postgresql14 openSUSE Tumbleweed 14.5-1.1

opensuse advisories openSUSE-SU-2024:12264-1openSUSE-SU-2024:12265-1openSUSE-SU-2024:12266-1openSUSE-SU-2024:12267-1openSUSE-SU-2024:12268-1

  • postgresql AlmaLinux 9 13.10-1.el9_1
  • postgresql-test AlmaLinux 9 13.10-1.el9_1
  • postgresql-pltcl AlmaLinux 9 13.10-1.el9_1
  • postgresql-plperl AlmaLinux 9 13.10-1.el9_1
  • postgresql-server AlmaLinux 9 13.10-1.el9_1
  • postgresql-contrib AlmaLinux 9 13.10-1.el9_1
  • postgresql-upgrade AlmaLinux 9 13.10-1.el9_1
  • postgresql-plpython3 AlmaLinux 9 13.10-1.el9_1

almalinux advisories ALSA-2023:1693ALSA-2023:1576ALSA-2023:0113ALSA-2022:7128

  • pgaudit Rocky Linux 8 1.5.0-1.module+el8.5.0+684+c3892ef9
  • pg_repack Rocky Linux 8 1.4.6-3.module+el8.5.0+684+c3892ef9
  • postgresql Rocky Linux 8 13.10-1.module+el8.7.0+1175+026203e7
  • postgres-decoderbufs Rocky Linux 8 0.10.0-2.module+el8.5.0+684+c3892ef9
  • postgresql Rocky Linux 8 10.23-1.module+el8.7.0+1118+c6c6f44a
  • pgaudit Rocky Linux 8 1.4.0-5.module+el8.5.0+686+20453ecc
  • postgresql Rocky Linux 8 12.12-1.module+el8.6.0+1049+f8fc4c36
  • postgres-decoderbufs Rocky Linux 8 0.10.0-2.module+el8.4.0+424+71d47d9a

rocky linux advisories RLSA-2023:1576RLSA-2023:0113RLSA-2022:7128

  • postgresql Alpine 3.14, Alpine 3.13 13.8-r0
  • postgresql12 Alpine 3.18, Alpine 3.17, Alpine 3.16 +1 more 12.12-r0
  • postgresql13 Alpine 3.19, Alpine 3.18, Alpine 3.17 +2 more 13.8-r0
  • postgresql14 Alpine 3.20, Alpine 3.19, Alpine 3.18 +3 more 14.5-r0
  • postgresql15 Alpine 3.20, Alpine 3.19, Alpine 3.18 +1 more 14.5-r0

alpine advisories ALPINE-CVE-2022-2625

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • postgresql CBL-Mariner 2.0 14.5-1

azure linux advisories AZL-10595

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-2625 updated cvss 7.1

postgresql: Extension scripts replace objects not belonging to the extension.

  • Red Hat Enterprise Linux 6 postgresql, postgresql-libs, postgresql-test, postgresql-pltcl, postgresql-plperl, postgresql-server, +2 more Red Hat Enterprise Linux 7 postgresql, postgresql-libs, postgresql-test, postgresql-pltcl, postgresql-plperl, postgresql-server, +3 more
    affected: no fix planned “Out of support scope”
  • Red Hat Software Collections rh-postgresql12-postgresql, rh-postgresql13-postgresql, rh-postgresql12-postgresql-libs, rh-postgresql12-postgresql-test, rh-postgresql13-postgresql-libs, rh-postgresql13-postgresql-test, +17 more
    affected: no fix planned “Will not fix”
  • Red Hat CodeReady Linux Builder (v. 9) postgresql-test 13.10-1.el9_1
    fixed: vendor fix RHSA-2023:1693
  • Red Hat CodeReady Linux Builder EUS (v.9.0) postgresql-test 13.13-1.el9_0
    fixed: vendor fix RHSA-2023:7545
  • Red Hat Enterprise Linux AppStream (v. 8) pgaudit 1.5.0-1.module+el8.4.0+8873+b821c30a, pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5, pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5, pg_repack 1.4.6-3.module+el8.5.0+11357+bcc62552, postgresql 10.23-1.module+el8.7.0+17280+3a452e1f, postgresql 12.12-1.module+el8.6.0+16796+0abe6678, +27 more
    fixed: vendor fix RHSA-2022:7128
  • Red Hat Enterprise Linux AppStream (v. 9) postgresql 13.10-1.el9_1, postgresql-pltcl 13.10-1.el9_1, postgresql-plperl 13.10-1.el9_1, postgresql-server 13.10-1.el9_1, postgresql-contrib 13.10-1.el9_1, postgresql-upgrade 13.10-1.el9_1, +2 more
    fixed: vendor fix RHSA-2023:1693
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) pgaudit 1.4.0-4.module+el8.2.0+9043+1dbb5661, postgresql 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-test 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-pltcl 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-plperl 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-server 12.17-1.module+el8.2.0+20720+50ffbc0b, +5 more
    fixed: vendor fix RHSA-2023:7667
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit 1.5.0-1.module+el8.4.0+8873+b821c30a, pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7, postgresql 12.17-1.module+el8.4.0+20773+7c41d490, postgresql 13.13-1.module+el8.4.0+20774+68ad636d, postgresql-test 12.17-1.module+el8.4.0+20773+7c41d490, postgresql-test 13.13-1.module+el8.4.0+20774+68ad636d, +16 more
    fixed: vendor fix RHSA-2023:7694
show 7 more
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) pgaudit 1.4.0-4.module+el8.2.0+9043+1dbb5661, postgresql 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-test 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-pltcl 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-plperl 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-server 12.17-1.module+el8.2.0+20720+50ffbc0b, +5 more
    fixed: vendor fix RHSA-2023:7667
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) pgaudit 1.5.0-1.module+el8.4.0+8873+b821c30a, pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7, postgresql 12.17-1.module+el8.4.0+20773+7c41d490, postgresql 13.13-1.module+el8.4.0+20774+68ad636d, postgresql-test 12.17-1.module+el8.4.0+20773+7c41d490, postgresql-test 13.13-1.module+el8.4.0+20774+68ad636d, +16 more
    fixed: vendor fix RHSA-2023:7694
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) pgaudit 1.5.0-1.module+el8.4.0+8873+b821c30a, pg_repack 1.4.6-3.module+el8.5.0+11357+bcc62552, postgresql 13.13-1.module+el8.6.0+20665+ba8c5a93, postgresql-test 13.13-1.module+el8.6.0+20665+ba8c5a93, postgresql-pltcl 13.13-1.module+el8.6.0+20665+ba8c5a93, postgresql-plperl 13.13-1.module+el8.6.0+20665+ba8c5a93, +6 more
    fixed: vendor fix RHSA-2023:7580
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) postgresql 13.13-1.el9_0, postgresql-pltcl 13.13-1.el9_0, postgresql-plperl 13.13-1.el9_0, postgresql-server 13.13-1.el9_0, postgresql-contrib 13.13-1.el9_0, postgresql-upgrade 13.13-1.el9_0, +2 more
    fixed: vendor fix RHSA-2023:7545
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) pgaudit 1.4.0-4.module+el8.2.0+9043+1dbb5661, postgresql 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-test 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-pltcl 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-plperl 12.17-1.module+el8.2.0+20720+50ffbc0b, postgresql-server 12.17-1.module+el8.2.0+20720+50ffbc0b, +5 more
    fixed: vendor fix RHSA-2023:7667
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) pgaudit 1.5.0-1.module+el8.4.0+8873+b821c30a, pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7, postgresql 12.17-1.module+el8.4.0+20773+7c41d490, postgresql 13.13-1.module+el8.4.0+20774+68ad636d, postgresql-test 12.17-1.module+el8.4.0+20773+7c41d490, postgresql-test 13.13-1.module+el8.4.0+20774+68ad636d, +16 more
    fixed: vendor fix RHSA-2023:7694
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-postgresql10-postgresql 10.23-1.el7, rh-postgresql10-postgresql-libs 10.23-1.el7, rh-postgresql10-postgresql-test 10.23-1.el7, rh-postgresql10-postgresql-pltcl 10.23-1.el7, rh-postgresql10-postgresql-plperl 10.23-1.el7, rh-postgresql10-postgresql-server 10.23-1.el7, +5 more Red Hat Software Collections for RHEL(v. 7) rh-postgresql10-postgresql 10.23-1.el7, rh-postgresql10-postgresql-libs 10.23-1.el7, rh-postgresql10-postgresql-test 10.23-1.el7, rh-postgresql10-postgresql-pltcl 10.23-1.el7, rh-postgresql10-postgresql-plperl 10.23-1.el7, rh-postgresql10-postgresql-server 10.23-1.el7, +5 more
    fixed: vendor fix RHSA-2023:0160

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
31 d ago

Exploit prediction

2.15% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
OSV 3.1 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami postgresql
>=10.0.0, <10.22.0
>=11.0.0, <11.17.0
>=12.0.0, <12.12.0
>=13.0.0, <13.8.0
>=14.0.0, <14.5.0
10.22.0
11.17.0
12.12.0
13.8.0
14.5.0
julia LibPQ_jll
<16.0.0+0
16.0.0+0

Affected products

  • n/a postgresql

Classification

Weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.