CyberRota Analysis
AI-GeneratedThe pg_partman extension for PostgreSQL prior to version 5.5.0 is vulnerable due to improper handling of primary-key column names, allowing a partman_user to craft malicious column names that can execute arbitrary SQL commands with superuser privileges. This vulnerability can lead to a complete database compromise and potential operating-system command execution under the PostgreSQL service account. Database administrators using affected versions should prioritize upgrading to version 5.5.0 or later to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier when the background worker applies the key to a child partition. The generated SQL then executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The crafted catalog identifier persists until removed and can trigger again during later partition creation. This issue is fixed in version 5.5.0.