Important: postgresql:15 security update
Summary
ALSA-2023:7884: Important: postgresql:15 security update. Affects pg_repack versions < 1.4.8-1.module_el8.8.0+3487+43ec1b9f. Fixed in 1.4.8-1.module_el8.8.0+3487+43ec1b9f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) that provides robust data storage and retrieval capabilities. It is widely used in various applications and industries for managing large volumes of structured data. The vulnerability affects the PostgreSQL package version 15.
Vulnerability Detail
The vulnerability includes multiple security fixes:
-
Buffer overrun from integer overflow in array modification (CVE-2023-5869): This vulnerability could allow an attacker to overrun a buffer and potentially execute arbitrary code.
-
Memory disclosure in aggregate function calls (CVE-2023-5868): This vulnerability could lead to the disclosure of sensitive information through aggregate function calls.
-
SQL injection via extension script (CVE-2023-39417): This vulnerability allows an attacker to inject malicious SQL code through extension scripts, potentially leading to unauthorized access or data manipulation.
-
Role pg_signal_backend can signal certain superuser processes (CVE-2023-5870): This vulnerability allows a user with the pg_signal_backend role to signal certain superuser processes, potentially leading to privilege escalation.
-
Failure to enforce row security policies in MERGE (CVE-2023-39418): This vulnerability allows an attacker to bypass row security policies in the MERGE command, potentially leading to unauthorized data access or modification.
How To Fix
Minimum fixed version
1.4.8-1.module_el8.8.0+3487+43ec1b9f
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update as soon as possible to mitigate the risk.
Conclusion
In conclusion, the PostgreSQL package version 15 is affected by multiple vulnerabilities that could lead to arbitrary code execution, information disclosure, SQL injection, privilege escalation, and bypassing of row security policies. It is crucial to update the package to version 15.5-1.module_el8.9.0+3706+885c732e or later to mitigate these risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for pg_repack →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness and scalability. It is widely used in various applications and industries.
These vulnerabilities could allow an attacker to execute arbitrary code, disclose sensitive information, perform SQL injection attacks, escalate privileges, and bypass row security policies.
To fix the vulnerabilities, it is recommended to update the PostgreSQL package to version 15.5-1.module_el8.9.0+3706+885c732e or later.
There are no known workarounds for these vulnerabilities. It is crucial to apply the security update to mitigate the risk.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
