Moderate: postgresql:13 security update
Summary
ALSA-2023:1576: Moderate: postgresql:13 security update. Affects pg_repack across 2 version ranges.
< 1.4.6-3.module_el8.6.0+2760+1746ec94
< 1.4.6-3.module_el8.6.0+3095+ee60d910
Fixed in 1.4.6-3.module_el8.6.0+2760+1746ec94 or 1.4.6-3.module_el8.6.0+3095+ee60d910, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS). It is widely used for storing and managing large amounts of data in various applications. PostgreSQL provides a robust and feature-rich environment for data storage and retrieval, making it a popular choice among developers and organizations. However, like any software, PostgreSQL is susceptible to security vulnerabilities that can potentially compromise the confidentiality, integrity, and availability of the data it manages.
Vulnerability Detail
The vulnerability identified in this security update affects PostgreSQL version 13. It includes two security fixes:
-
CVE-2022-2625: This vulnerability allows extension scripts to replace objects that do not belong to the extension. An attacker with the necessary privileges could exploit this vulnerability to modify or replace database objects, potentially leading to unauthorized access or data manipulation.
-
CVE-2022-41862: This vulnerability results in client memory disclosure when connecting with Kerberos to a modified server. An attacker could exploit this vulnerability to obtain sensitive information from the client's memory, potentially exposing confidential data or credentials.
These vulnerabilities pose a moderate risk and should be addressed promptly to ensure the security and integrity of PostgreSQL installations.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update pg_repack-
< 1.4.6-3.module_el8.6.0+2760+1746ec941.4.6-3.module_el8.6.0+2760+1746ec94 -
< 1.4.6-3.module_el8.6.0+3095+ee60d9101.4.6-3.module_el8.6.0+3095+ee60d910
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update to mitigate the risks associated with the vulnerabilities.
Conclusion
In conclusion, PostgreSQL version 13 is affected by two moderate security vulnerabilities. To ensure the security and integrity of your PostgreSQL installations, it is crucial to update to the latest version (13.10) that includes the necessary fixes. Regularly monitoring for vulnerabilities and promptly applying security updates is essential to protect your data and mitigate potential risks. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for pg_repack →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, scalability, and extensive feature set. It is widely used in various applications and industries.
These vulnerabilities could potentially allow unauthorized access, data manipulation, and disclosure of sensitive information. It is crucial to address these vulnerabilities promptly to protect the integrity and security of PostgreSQL installations.
You can use vulnerability monitoring tools like Vulert to check if your PostgreSQL installation is affected by these vulnerabilities. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in software.
There are no known workarounds for these vulnerabilities. It is recommended to update PostgreSQL to the latest version to mitigate the risks.
You can refer to the CVE pages listed in the References section of the vulnerability details for more information about these vulnerabilities, including their impact, CVSS score, acknowledgments, and related information.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
