Is CVE-2022-2625 in the CISA KEV catalog?

No. CVE-2022-2625 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2022-2625?

CVE-2022-2625 has a CVSS v3 base score of 8.0 (HIGH).

What is the EPSS score for CVE-2022-2625?

CVE-2022-2625 has an EPSS score of 1.52% (71th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2022-2625?

Upgrade postgresql-13 on debian 11 to 13.8-0+deb11u1 or later. Fixes are available for 78 affected products.

CVE & CISA-KEV Catalog

CVE-2022-2625

HIGHEPSS 71th pctl

8.0

CVSS v3

NVD

Description

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

CWE-915 CWE-1321

How to fix

Remediation Available

postgresql-13Debian

Fixed in:13.8-0+deb11u1CVE-2022-2625

pg_repackRocky

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13RHSA-2023:7580

pg_repackRed Hat / RHEL

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13RHSA-2023:7580

pg_repack-debuginfoRed Hat / RHEL

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13RHSA-2023:7580

pg_repack-debuginfoRocky

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13RHSA-2023:7580

pg_repack-debugsourceRed Hat / RHEL

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13RHSA-2023:7580

pg_repack-debugsourceRocky

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13RHSA-2023:7580

pgauditRed Hat / RHEL

Fixed in:0:1.4.0-6.module+el8.4.0+11288+c193d6d7.s390x::postgresql:12RHSA-2023:7694

Fixed in:0:1.4.0-4.module+el8.2.0+9043+1dbb5661.ppc64le::postgresql:12RHSA-2023:7667

Fixed in:0:1.5.0-1.module+el8.4.0+8873+b821c30a.s390x::postgresql:13RHSA-2023:7695

Fixed in:0:1.4.0-6.module+el8.4.0+11288+c193d6d7.ppc64le::postgresql:12RHSA-2023:7694

Fixed in:0:1.4.0-6.module+el8.4.0+11288+c193d6d7.x86_64::postgresql:12RHSA-2023:7694

Fixed in:0:1.5.0-1.module+el8.4.0+8873+b821c30a.ppc64le::postgresql:13RHSA-2023:7695

Fixed in:0:1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13RHSA-2023:7695

Fixed in:0:1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13RHSA-2023:7580

Fixed in:0:1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13RHSA-2023:7695

Fixed in:0:1.4.0-4.module+el8.2.0+9043+1dbb5661.x86_64::postgresql:12RHSA-2023:7667

Fixed in:0:1.4.0-4.module+el8.2.0+9043+1dbb5661.src::postgresql:12RHSA-2023:7667

Fixed in:0:1.5.0-1.module+el8.4.0+8873+b821c30a.s390x::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.0-6.module+el8.4.0+11288+c193d6d7.aarch64::postgresql:12RHSA-2023:7694

Fixed in:0:1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13RHSA-2023:7580

Fixed in:0:1.4.0-6.module+el8.4.0+11288+c193d6d7.src::postgresql:12RHSA-2023:7694

Fixed in:0:1.5.0-1.module+el8.4.0+8873+b821c30a.aarch64::postgresql:13RHSA-2023:7695

Fixed in:0:1.5.0-1.module+el8.4.0+8873+b821c30a.aarch64::postgresql:13RHSA-2023:7580

Fixed in:0:1.5.0-1.module+el8.4.0+8873+b821c30a.ppc64le::postgresql:13RHSA-2023:7580

pgauditRocky