CVE-2020-14349

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.

• CWE-89
• CWE-427

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.htmlBroken Link, Mailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1865744Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/202008-13Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200918-0002/Third Party Advisory
• https://usn.ubuntu.com/4472-1/Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.htmlBroken Link, Mailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1865744Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/202008-13Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200918-0002/Third Party Advisory
• https://usn.ubuntu.com/4472-1/Third Party Advisory

Published

Aug 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14343A vulnerability was discovered in the PyYAML library in vers…9.8
• CVE-2020-14344An integer overflow leading to a heap-buffer overflow was fo…6.7
• CVE-2020-14345A flaw was found in X.Org Server before xorg-x11-server 1.20…7.8
• CVE-2020-14346A flaw was found in xorg-x11-server before 1.20.9. An intege…7.8
• CVE-2020-14347A flaw was found in the way xserver memory was not properly …5.5
• CVE-2020-14348It was found in AMQ Online before 1.5.2 that injecting an in…4.3
• CVE-2020-1435A remote code execution vulnerability exists in the way that…8.8
• CVE-2020-14350It was found that some PostgreSQL extensions did not use sea…7.3
• CVE-2020-14351A flaw was found in the Linux kernel. A use-after-free memor…7.8
• CVE-2020-14352A flaw was found in librepo in versions before 1.12.1. A dir…8
• CVE-2020-14353Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-14354A possible use-after-free and double-free in c-ares lib vers…3.3