Postgresql Anonymizer
Approved changes feed: RSS · Atom
cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Dalibo (13dd13b9-9c3e-5009-9833-0fccc026be35) |
|---|---|
| Product | Postgresql Anonymizer (ab088a2f-30ae-5e97-8114-cce55623dd12) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:gitlab/dalibo/postgresql_anonymizer |
purl2cpe | 2026-06-19 13:12:42.746456 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-19634 |
vulnerable | 2026-09-16 04:34:15.712222 |
PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON
MEDIUM (6.4)
PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() or anon.import_roles_rules(), the malicious code is executed with superuser privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later
Published: 2026-09-06T15:25:36.947Z
Updated: 2026-09-09T04:26:02.535Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-19633 |
vulnerable | 2026-09-16 04:34:15.420049 |
PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries
HIGH (8.8)
PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the malicious code can run with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later versions
Published: 2026-09-06T15:25:32.533Z
Updated: 2026-09-09T04:26:01.195Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-83534 |
vulnerable | 2026-09-16 04:32:48.749932 |
PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()
MEDIUM (6.4)
PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions
Published: 2026-09-06T15:25:41.341Z
Updated: 2026-09-09T04:26:03.815Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13455 |
vulnerable | 2026-07-29 00:23:33.061778 |
PostgreSQL Anonymizer: Unrestricted function can leak the secret salt
MEDIUM (4.3)
PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. The problem is resolved in PostgreSQL Anonymizer 3.1.2 and later versions
Published: 2026-06-30T15:19:57.657Z
Updated: 2026-06-30T15:57:53.085Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11945 |
vulnerable | 2026-07-29 00:23:31.823321 |
PostgreSQL Anonymizer: SQL injection in the rules import functions
MEDIUM (6.4)
PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a particular key-value pair. If a superuser calls the import_database_rules() or import_roles_rules() functions, the malicious code is executed with superuser privileges. The problem is resolved in PostgreSQL Anonymizer 3.1.1 and further versions
Published: 2026-06-11T15:53:24.223Z
Updated: 2026-06-12T03:55:36.254Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-9617 |
vulnerable | 2026-06-08 08:08:59.062845 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-2361 |
vulnerable | 2026-06-08 07:55:16.956594 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-2360 |
vulnerable | 2026-06-08 07:55:16.956291 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-5690 |
vulnerable | 2026-06-08 07:37:25.463928 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2339 |
vulnerable | 2026-06-08 06:33:30.894887 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2338 |
vulnerable | 2026-06-08 06:33:30.893431 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.