Vulnerability in postgresql:13 package
Summary
ALBA-2022:1832: postgresql:13 bug fix and enhancement update. Affects pg_repack across 2 version ranges.
< 1.4.6-3.module_el8.6.0+2758+4f4474df
< 1.4.6-3.module_el8.6.0+2760+1746ec94
Fixed in 1.4.6-3.module_el8.6.0+2758+4f4474df or 1.4.6-3.module_el8.6.0+2760+1746ec94, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The postgresql:13 package is a widely used open-source relational database management system. It provides robust data storage and retrieval capabilities for various applications. This vulnerability affects the package and requires immediate attention to ensure the security and integrity of the database.
Vulnerability Detail
The vulnerability in the postgresql:13 package allows attackers to exploit certain bugs and security weaknesses. This can lead to unauthorized access, data leakage, or even remote code execution. It is crucial to address this vulnerability promptly to prevent potential breaches and protect sensitive data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update pg_repack-
< 1.4.6-3.module_el8.6.0+2758+4f4474df1.4.6-3.module_el8.6.0+2758+4f4474df -
< 1.4.6-3.module_el8.6.0+2760+1746ec941.4.6-3.module_el8.6.0+2760+1746ec94
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is essential to apply the recommended fix by updating the postgresql:13 package to the latest version.
Conclusion
The vulnerability in the postgresql:13 package poses a significant risk to the security and integrity of the database. It is crucial to update the package to the latest version to address the identified security issues. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pg_repack →
FAQ
This vulnerability can lead to unauthorized access, data leakage, or remote code execution in the postgresql:13 package.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will alert you in real-time if any open-source vulnerabilities, including this one, are detected.
At the time of this report, there is no known exploit publicly available for this vulnerability. However, it is crucial to address it promptly to mitigate any potential risks.
The specific prerequisites for exploiting this vulnerability are not mentioned in the provided information. However, it is always recommended to keep software and packages up to date to minimize the risk of exploitation.
You can find more information about this vulnerability, including the detailed advisory and fix, in the AlmaLinux OSV Database advisory: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
