CVE-2022-2625

Description

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

How to fix CVE-2022-2625

To remediate CVE-2022-2625, upgrade the affected package to a fixed version below.

—upgrade to 13.8-r0 or later
—upgrade to 13.8-r0 or later
—upgrade to 14.5-r0 or later
—upgrade to 14.5-r0 or later
—upgrade to 10.22.0 or later
—upgrade to 11.17-0+deb10u1 or later
—upgrade to 13.8-0+deb11u1 or later

Is CVE-2022-2625 being exploited?

Low — EPSS is 1.0%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

from 0, < 13.8-r0
from 0, < 13.8-r0
from 0, < 14.5-r0
from 0, < 14.5-r0
>= 10.0.0, < 10.22.0, >= 11.0.0, < 11.17.0, >= 12.0.0, < 12.12.0, >= 13.0.0, < 13.8.0, >= 14.0.0, < 14.5.0
from 0, < 11.17-0+deb10u1
from 0, < 13.8-0+deb11u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H