PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00918.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Postgresql
  • Postgresql
Redhat
  • Cloudforms Managementengine
  • Enterprise Linux
  • Rhel Software Collections

Configuration 1 [-]

OR cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.12:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.13:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.14:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.15:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.16:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.17:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.18:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.12:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.13:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.14:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.15:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.3.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.3.2:*:*:*:*:*:*:*
Package CPE Advisory Released Date
CloudForms Management Engine 5.x
cfme-0:5.2.3.2-1.el6cf cpe:/a:redhat:cloudforms_managementengine:5::el6 RHSA-2014:0469 2014-05-12T00:00:00Z
postgresql92-postgresql-0:9.2.7-1.1.el6 cpe:/a:redhat:cloudforms_managementengine:5::el6 RHSA-2014:0469 2014-05-12T00:00:00Z
prince-0:9.0r2-4.el6cf cpe:/a:redhat:cloudforms_managementengine:5::el6 RHSA-2014:0469 2014-05-12T00:00:00Z
ruby193-rubygem-actionpack-1:3.2.13-6.el6cf cpe:/a:redhat:cloudforms_managementengine:5::el6 RHSA-2014:0469 2014-05-12T00:00:00Z
Red Hat Enterprise Linux 5
postgresql84-0:8.4.20-1.el5_10 cpe:/o:redhat:enterprise_linux:5 RHSA-2014:0211 2014-02-25T00:00:00Z
postgresql-0:8.1.23-10.el5_10 cpe:/o:redhat:enterprise_linux:5 RHSA-2014:0249 2014-03-04T00:00:00Z
Red Hat Enterprise Linux 6
postgresql-0:8.4.20-1.el6_5 cpe:/o:redhat:enterprise_linux:6 RHSA-2014:0211 2014-02-25T00:00:00Z
Red Hat Software Collections for RHEL-6
postgresql92-postgresql-0:9.2.7-1.1.el6 cpe:/a:redhat:rhel_software_collections:1::el6 RHSA-2014:0221 2014-02-27T00:00:00Z

No data.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-2864-1 postgresql-8.4 security update
Debian DSA Debian DSA DSA-2865-1 postgresql-9.1 security update
EUVD EUVD EUVD-2014-0153 PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.
Ubuntu USN Ubuntu USN USN-2120-1 PostgreSQL vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html cve-icon cve-icon
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 cve-icon cve-icon
http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-updates/2014-03/msg00038.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2014-0211.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2014-0221.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2014-0249.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2014-0469.html cve-icon cve-icon
http://secunia.com/advisories/61307 cve-icon cve-icon
http://support.apple.com/kb/HT6448 cve-icon cve-icon
http://wiki.postgresql.org/wiki/20140220securityrelease cve-icon cve-icon
http://www.debian.org/security/2014/dsa-2864 cve-icon cve-icon
http://www.debian.org/security/2014/dsa-2865 cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html cve-icon cve-icon
http://www.postgresql.org/about/news/1506/ cve-icon cve-icon
http://www.ubuntu.com/usn/USN-2120-1 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2014-0060 cve-icon
https://puppet.com/security/cve/cve-2014-0060 cve-icon cve-icon
https://support.apple.com/kb/HT6536 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2014-0060 cve-icon
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-06T09:05:38.375Z

Reserved: 2013-12-03T00:00:00

Link: CVE-2014-0060

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2014-03-31T14:58:08.663

Modified: 2025-04-12T10:46:40.837

Link: CVE-2014-0060

cve-icon Redhat

Severity : Moderate

Publid Date: 2014-02-17T00:00:00Z

Links: CVE-2014-0060 - Bugzilla

cve-icon OpenCVE Enrichment

No data.