CVE-2022-2625: 
PostgreSQL vulnerability analysis and mitigation

A vulnerability (CVE-2022-2625) was discovered in PostgreSQL affecting versions 10.0 through 14.4. The vulnerability was disclosed on August 11, 2022, impacting PostgreSQL's extension script handling mechanism (PostgreSQL News).

The vulnerability stems from extension scripts using CREATE OR REPLACE or CREATE IF NOT EXISTS commands without adhering to the documented rule of targeting only objects known to be extension members. The vulnerability has a CVSS v3.1 base score of 8.0 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (NVD).

If successfully exploited, this vulnerability allows an attacker to execute arbitrary code as the victim role, which may potentially have superuser privileges. The impact affects both PostgreSQL-bundled and non-bundled extensions (PostgreSQL News).

Exploitation requires three prerequisites: permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS (NVD).

PostgreSQL has addressed this vulnerability by blocking the attack in the core server, eliminating the need to modify individual extensions. Fixed versions include PostgreSQL 14.5, 13.8, 12.12, 11.17, and 10.22. Users are advised to upgrade to these patched versions (PostgreSQL News).