An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. When using UTL_ENCODE, an authenticated user can read any large object, regardless of that users permissions.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Postgres_advanced_server | Enterprisedb | * | 11.21.32 (excluding) |
| Postgres_advanced_server | Enterprisedb | 12.0.0 (including) | 12.16.20 (excluding) |
| Postgres_advanced_server | Enterprisedb | 13.0.0 (including) | 13.12.17 (excluding) |
| Postgres_advanced_server | Enterprisedb | 14.0.0 (including) | 14.9.0 (excluding) |
| Postgres_advanced_server | Enterprisedb | 15.0.0 (including) | 15.4.0 (excluding) |