CVE-2020-1720: 
PostgreSQL vulnerability analysis and mitigation

A security vulnerability was discovered in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION" feature, identified as CVE-2020-1720. The flaw was found where sub-commands did not perform proper authorization checks. This vulnerability affects PostgreSQL versions before 12.2, 11.7, 10.12, and 9.6.17, with versions 9.5 and older not being affected as they didn't support this feature (PostgreSQL News, NVD).

The vulnerability stems from missing authorization checks in the ALTER ... DEPENDS ON EXTENSION sub-commands. The issue received a CVSS v3.1 Base Score of 6.5 (MEDIUM) according to NVD assessment, while Red Hat assessed it with a Base Score of 3.1 (LOW). The vulnerability is classified under CWE-862 (Missing Authorization) and CWE-285 (Improper Authorization) (NVD).

When exploited, this vulnerability allows an authenticated attacker to drop objects such as functions, procedures, materialized views, indexes, or triggers under certain conditions, potentially leading to database corruption. The impact primarily affects database integrity without compromising confidentiality or availability (NVD, PostgreSQL News).

The vulnerability was patched in PostgreSQL versions 12.2, 11.7, 10.12, and 9.6.17. Users are advised to upgrade to these versions or later. The update does not require a database dump and reload; users can simply shutdown PostgreSQL and update its binaries (PostgreSQL News).