DALIBO PostgreSQL Anonymizer.

PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking

• DALIBO PostgreSQL Anonymizer
• CWE-202

PostgreSQL Anonymizer: anon.partial() and anon.partial_email() can reveal the whole data

• DALIBO PostgreSQL Anonymizer
• CWE-693

PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data

• DALIBO PostgreSQL Anonymizer
• CWE-693

PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query

• DALIBO PostgreSQL Anonymizer
• Broken access control

PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views

• DALIBO PostgreSQL Anonymizer
• Broken access control

PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent

• DALIBO PostgreSQL Anonymizer
• Broken access control

PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule

• DALIBO PostgreSQL Anonymizer
• Information disclosure

PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting

• DALIBO PostgreSQL Anonymizer
• Information disclosure

PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats

• DALIBO PostgreSQL Anonymizer
• CWE-202

PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur()

• DALIBO PostgreSQL Anonymizer
• Denial of service

PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functions

• DALIBO PostgreSQL Anonymizer
• Denial of service

PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles

• DALIBO PostgreSQL Anonymizer
• Broken access control

PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink

• DALIBO PostgreSQL Anonymizer
• Weak cryptography or TLS

PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()

• DALIBO PostgreSQL Anonymizer
• Privilege escalation

PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON

• DALIBO PostgreSQL Anonymizer
• SQL injection

PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries

• DALIBO PostgreSQL Anonymizer
• SQL injection

PostgreSQL Anonymizer: Unrestricted function can leak the secret salt

• DALIBO PostgreSQL Anonymizer
• Weak cryptography or TLS

PostgreSQL Anonymizer: SQL injection in the rules import functions

• DALIBO PostgreSQL Anonymizer
• SQL injection

PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() function

• DALIBO PostgreSQL Anonymizer
• SQL injection

Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user with create privilege to gain superuser privileges

• DALIBO PostgreSQL Anonymizer
• CWE-427

Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14

• DALIBO PostgreSQL Anonymizer
• CWE-427

Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic data

• DALIBO PostgreSQL Anonymizer
• Information disclosure

Improper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule

• DALIBO PostgreSQL Anonymizer
• CWE-20

SQL Injection in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule

• DALIBO PostgreSQL Anonymizer
• SQL injection