PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• gitlab.com/dalibo/postgresql_anonymizer/-/issues/718 Diğer

Kayıt geçmişi

1. 28 Eki 2026 20:31Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-110182PostgreSQL Anonymizer: anon.partial() and anon.partial_email() can reveal the whole data
• 4,3 CVE-2026-110183PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking
• 6,5 CVE-2026-105620PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query
• 5,7 CVE-2026-105618PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent
• 4,8 CVE-2026-105619PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views
• 5,7 CVE-2026-105617PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule