Red Hat Advanced Cluster Security 4.2 vulnerability

What happened

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

Affected versions

Red Hat Advanced Cluster Security 4.2: 11.0 through before 11.21; 12.0 through before 12.16; 13.0 through before 13.12; 14.0 through before 14.9; 15.0 through before 15.4 Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.