CVE-2022-2625: 
PostgreSQL vulnerability analysis and mitigation

A vulnerability (CVE-2022-2625) was discovered in PostgreSQL affecting versions 10.0 through 14.4. The vulnerability was disclosed on August 11, 2022, impacting PostgreSQL's extension script handling mechanism (PostgreSQL News).

The vulnerability stems from extension scripts using CREATE OR REPLACE or CREATE IF NOT EXISTS commands without adhering to the documented rule of targeting only objects known to be extension members. The vulnerability has a CVSS v3.1 base score of 8.0 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (NVD).

If successfully exploited, this vulnerability allows an attacker to execute arbitrary code as the victim role, which may potentially have superuser privileges. The impact affects both PostgreSQL-bundled and non-bundled extensions (PostgreSQL News).

PostgreSQL has addressed this vulnerability by blocking the attack in the core server, eliminating the need to modify individual extensions. Fixed versions include PostgreSQL 14.5, 13.8, 12.12, 11.17, and 10.22. Users are advised to upgrade to these patched versions (PostgreSQL News).