A postgresql-9.4 security update has been released for Debian GNU/Linux 8 Extended LTS to address an issue where an uncontrolled search path could allow users to run arbitrary SQL functions with elevated priviledges when a superuser runs certain `CREATE EXTENSION’ statements.

ELA-267-1 postgresql-9.4 security update

Package postgresql-9.4
Version 9.4.26-0+deb8u3
Related CVEs CVE-2020-14350

Andres Freund found an issue in the PostgreSQL database system where an uncontrolled search path could allow users to run arbitrary SQL functions with elevated priviledges when a superuser runs certain `CREATE EXTENSION’ statements.

For Debian 8 jessie, these problems have been fixed in version 9.4.26-0+deb8u3.

We recommend that you upgrade your postgresql-9.4 packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

  ELA-267-1 postgresql-9.4 security update