Threats affecting pkg:github/dalibo/postgresql_anonymizer

PostgreSQL Anonymizer versions prior to 3.3.0 contain a vulnerability that allows data-modifying common table expressions (CTEs) to bypass the read-only restrictions imposed on masked roles. This issue is addressed in version 3.3.0 and later.

PostgreSQL Anonymizer versions before 3.2.3 contain a vulnerability in the anon.hash() function that allows unprivileged masked users to collect (seed, hash_output) pairs. This enables an offline brute-force attack to deduce the salt used in hashing. The issue is fixed in version 3.2.3 and later.

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. The problem is resolved in PostgreSQL Anonymizer 3.1.2 and later versions

PostgreSQL Anonymizer versions prior to 3.1.1 contain an SQL injection vulnerability that allows privilege escalation to superuser. The vulnerability occurs when a superuser calls import_database_rules() or import_roles_rules() with a crafted JSON document containing malicious code in a key-value pair. This code executes with superuser privileges. The issue is fixed in version 3.1.1 and later.

CVE-2026-9617 is a SQL injection vulnerability in the DALIBO PostgreSQL Anonymizer that allows a user to escalate privileges to superuser by injecting malicious code into a column identifier when creating a table. Execution of this code occurs if a superuser calls the k-anonymity function. The risk is higher on PostgreSQL 14 or instances upgraded from that version, while PostgreSQL 15 and later reduce risk by revoking public schema creation permissions by default. The vulnerability is fixed in PostgreSQL Anonymizer version 3.1.0 and later.

PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data using a database cursor or the --insert option of pg_dump. This problem occurs only when dynamic masking is enabled, which is not the default setting. The problem is resolved in version 2.2.1