Important: postgresql:12 security update
Summary
ALSA-2020:5620: Important: postgresql:12 security update. Affects postgres-decoderbufs across 2 version ranges.
< 0.10.0-2.module_el8.6.0+2758+4f4474df
< 0.10.0-2.module_el8.6.0+2760+1746ec94
Fixed in 0.10.0-2.module_el8.6.0+2758+4f4474df or 0.10.0-2.module_el8.6.0+2760+1746ec94, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS). It provides a robust and scalable platform for storing and managing data. PostgreSQL is widely used in various applications and industries due to its reliability and extensive feature set.
Vulnerability Detail
This security update addresses multiple vulnerabilities in PostgreSQL version 12.5. The vulnerabilities include:
-
CVE-2020-25694: Reconnection can downgrade connection security settings, potentially allowing an attacker to weaken the security of the connection.
-
CVE-2020-25695: Multiple features escape "security restricted operation" sandbox, which could lead to unauthorized access or privilege escalation.
-
CVE-2020-14349: Uncontrolled search path element in logical replication, enabling an attacker to execute arbitrary SQL commands.
-
CVE-2020-14350: Uncontrolled search path element in CREATE EXTENSION, allowing an attacker to execute arbitrary SQL commands.
-
CVE-2020-25696: psql's \gset allows overwriting specially treated variables, potentially leading to unauthorized access or privilege escalation.
-
CVE-2020-1720: ALTER ... DEPENDS ON EXTENSION is missing authorization checks, which could result in unauthorized modification of database objects.
These vulnerabilities pose a risk to the security and integrity of PostgreSQL databases, potentially allowing attackers to gain unauthorized access, execute arbitrary SQL commands, or escalate privileges.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update postgres-decoderbufs-
< 0.10.0-2.module_el8.6.0+2758+4f4474df0.10.0-2.module_el8.6.0+2758+4f4474df -
< 0.10.0-2.module_el8.6.0+2760+1746ec940.10.0-2.module_el8.6.0+2760+1746ec94
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
This security update addresses multiple vulnerabilities in PostgreSQL version 12.5. It is important to update PostgreSQL to ensure the security and integrity of your databases. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgres-decoderbufs →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) known for its reliability and extensive feature set. It provides a scalable platform for storing and managing data.
This security update addresses multiple vulnerabilities, including downgrading of connection security settings, sandbox escape, uncontrolled search path elements, overwriting of specially treated variables, and missing authorization checks.
These vulnerabilities could allow attackers to weaken connection security, gain unauthorized access, execute arbitrary SQL commands, or escalate privileges in PostgreSQL databases.
To fix these vulnerabilities, update PostgreSQL to the latest version (12.5). Follow the official documentation or consult your package manager for instructions on updating.
No specific workaround has been mentioned for these vulnerabilities. It is recommended to update PostgreSQL to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for postgres-decoderbufs.
