Aiven Extras PostgreSQL Extension Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Aiven Extras PostgreSQL extension, specifically in versions prior to 1.1.15. This vulnerability allows users to elevate their privileges to superuser within PostgreSQL databases that have the Aiven Extras package installed. The issue arises because the format function is not properly schema-prefixed, creating a loophole for privilege escalation.

Impact

Exploitation of this vulnerability allows for unauthorized elevation to superuser privileges in PostgreSQL databases using the Aiven Extras extension.

Remediation

Users are advised to upgrade to version 1.1.16 of the Aiven Extras PostgreSQL extension. After upgrading, it is necessary to run the command 'ALTER EXTENSION aiven_extras UPDATE TO '1.1.16'' in each database where Aiven Extras is installed.