PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00518.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a n/a affected
Version Status Constraints
n/a affected
—

Configuration 1 [-]

OR cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.12:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.13:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.14:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.15:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.16:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.17:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.18:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.12:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.13:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.14:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.15:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.3.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.3.2:*:*:*:*:*:*:*
Package CPE Advisory Released Date
CloudForms Management Engine 5.x
cfme-0:5.2.3.2-1.el6cf cpe:/a:redhat:cloudforms_managementengine:5::el6 RHSA-2014:0469 2014-05-12T00:00:00Z
postgresql92-postgresql-0:9.2.7-1.1.el6 cpe:/a:redhat:cloudforms_managementengine:5::el6 RHSA-2014:0469 2014-05-12T00:00:00Z
prince-0:9.0r2-4.el6cf cpe:/a:redhat:cloudforms_managementengine:5::el6 RHSA-2014:0469 2014-05-12T00:00:00Z
ruby193-rubygem-actionpack-1:3.2.13-6.el6cf cpe:/a:redhat:cloudforms_managementengine:5::el6 RHSA-2014:0469 2014-05-12T00:00:00Z
Red Hat Enterprise Linux 5
postgresql84-0:8.4.20-1.el5_10 cpe:/o:redhat:enterprise_linux:5 RHSA-2014:0211 2014-02-25T00:00:00Z
postgresql-0:8.1.23-10.el5_10 cpe:/o:redhat:enterprise_linux:5 RHSA-2014:0249 2014-03-04T00:00:00Z
Red Hat Enterprise Linux 6
postgresql-0:8.4.20-1.el6_5 cpe:/o:redhat:enterprise_linux:6 RHSA-2014:0211 2014-02-25T00:00:00Z
Red Hat Software Collections for RHEL-6
postgresql92-postgresql-0:9.2.7-1.1.el6 cpe:/a:redhat:rhel_software_collections:1::el6 RHSA-2014:0221 2014-02-27T00:00:00Z

No data.

Subscriptions

Vendors Products
Postgresql Subscribe
Postgresql Subscribe
Redhat Subscribe
Cloudforms Managementengine Subscribe
Enterprise Linux Subscribe
Rhel Software Collections Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-2864-1 postgresql-8.4 security update
Debian DSA Debian DSA DSA-2865-1 postgresql-9.1 security update
EUVD EUVD EUVD-2014-0153 PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.
Ubuntu USN Ubuntu USN USN-2120-1 PostgreSQL vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html cve-icon cve-icon
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 cve-icon cve-icon
http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-updates/2014-03/msg00038.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2014-0211.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2014-0221.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2014-0249.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2014-0469.html cve-icon cve-icon
http://secunia.com/advisories/61307 cve-icon cve-icon
http://support.apple.com/kb/HT6448 cve-icon cve-icon
http://wiki.postgresql.org/wiki/20140220securityrelease cve-icon cve-icon
http://www.debian.org/security/2014/dsa-2864 cve-icon cve-icon
http://www.debian.org/security/2014/dsa-2865 cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html cve-icon cve-icon
http://www.postgresql.org/about/news/1506/ cve-icon cve-icon
http://www.ubuntu.com/usn/USN-2120-1 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2014-0060 cve-icon
https://puppet.com/security/cve/cve-2014-0060 cve-icon cve-icon
https://support.apple.com/kb/HT6536 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2014-0060 cve-icon
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-06T09:05:38.375Z

Reserved: 2013-12-03T00:00:00.000Z

Link: CVE-2014-0060

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2014-03-31T14:58:08.663

Modified: 2025-04-12T10:46:40.837

Link: CVE-2014-0060

cve-icon Redhat

Severity : Moderate

Publid Date: 2014-02-17T00:00:00Z

Links: CVE-2014-0060 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses