Database superuser escalation via unqualified function calls

Privilege escalation in Aiven Extras before 1.1.9 allows local users to gain PostgreSQL superuser access via crafted schema objects. The pg_create_publication and set_pgaudit_parameter security-definer functions call routines such as array_length and format without the pg_catalog qualifier. A low-privileged database user who can create a colliding function on the search path can obtain unrestricted database access and execute code as the postgres host user.