Moderate: postgresql:15 security update
Summary
ALSA-2023:5269: Moderate: postgresql:15 security update. Affects pg_repack versions < 1.4.8-1.module_el8.8.0+3487+43ec1b9f. Fixed in 1.4.8-1.module_el8.8.0+3487+43ec1b9f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PostgreSQL is an advanced object-relational database management system (DBMS) that provides robust data storage and retrieval capabilities. It is widely used in various applications and industries for managing large volumes of structured data. The package 'postgresql' in AlmaLinux:8 is a distribution of PostgreSQL for the AlmaLinux operating system.
Vulnerability Detail
The vulnerability (CVE-2023-2454) in PostgreSQL allows an attacker to bypass protective search_path changes using the 'schema_element' function. This can lead to unauthorized access and potential data leakage. Another vulnerability (CVE-2023-2455) in PostgreSQL's row security policies allows an attacker to disregard user ID changes after inlining, potentially bypassing security measures. These vulnerabilities can be exploited by malicious actors to gain unauthorized access to sensitive data or perform unauthorized actions within the database.
How To Fix
Minimum fixed version
1.4.8-1.module_el8.8.0+3487+43ec1b9f
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
Conclusion
PostgreSQL is a widely used database management system, and it is crucial to keep it updated to protect against security vulnerabilities. It is recommended to apply the security update as soon as possible to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for pg_repack →
FAQ
PostgreSQL is an advanced object-relational database management system known for its reliability, scalability, and extensibility.
These vulnerabilities can allow unauthorized access to sensitive data and potentially bypass security measures in PostgreSQL.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update.
You can find more information about these vulnerabilities in the CVE pages: CVE-2023-2454 and CVE-2023-2455.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
