Important: PostgreSQL 12 Security Update
Summary
ALSA-2022:4807: Important: postgresql:12 security update. Affects pg_repack across 2 version ranges.
< 1.4.6-3.module_el8.6.0+2758+4f4474df
< 1.4.6-3.module_el8.6.0+2760+1746ec94
Fixed in 1.4.6-3.module_el8.6.0+2758+4f4474df or 1.4.6-3.module_el8.6.0+2760+1746ec94, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS). It provides a robust and scalable solution for storing and managing structured data. PostgreSQL is widely used in various applications and industries.
Vulnerability Detail
The PostgreSQL 12 security update addresses a vulnerability (CVE-2022-1552) related to autovacuum, REINDEX, and other operations. The issue involves the omission of a "security restricted operation" sandbox, which could potentially allow unauthorized access or privilege escalation. This vulnerability has been classified as important.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update pg_repack-
< 1.4.6-3.module_el8.6.0+2758+4f4474df1.4.6-3.module_el8.6.0+2758+4f4474df -
< 1.4.6-3.module_el8.6.0+2760+1746ec941.4.6-3.module_el8.6.0+2760+1746ec94
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to apply the security update as soon as possible to ensure the protection of your PostgreSQL installation.
Conclusion
The PostgreSQL 12 security update addresses an important vulnerability that could potentially allow unauthorized access or privilege escalation. It is crucial to update your PostgreSQL installation to version 12.11 or later to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for pg_repack →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, scalability, and extensibility.
The vulnerability (CVE-2022-1552) could potentially allow unauthorized access or privilege escalation in PostgreSQL installations.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your PostgreSQL installation is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.
Yes, a security update (version 12.11 or later) is available to address this vulnerability. It is recommended to update your PostgreSQL installation as soon as possible.
You can refer to the CVE page (CVE-2022-1552) for more details about this vulnerability, including its impact, CVSS score, acknowledgments, and related information.
References
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
