Important: postgresql:9.6 security update
Summary
ALSA-2021:2360: Important: postgresql:9.6 security update. Affects postgresql across 3 version ranges.
< 9.6.22-1.module_el8.4.0+2479+beebcf7e
< 9.6.22-1.module_el8.4.0+2492+beebcf7e
< 9.6.22-1.module_el8.5.0+58+52470387
Fixed in 9.6.22-1.module_el8.4.0+2479+beebcf7e, 9.6.22-1.module_el8.4.0+2492+beebcf7e or 9.6.22-1.module_el8.5.0+58+52470387, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS). It is widely used for storing and managing large amounts of data in various applications. The vulnerability affects the PostgreSQL package version 9.6.22 in the AlmaLinux 8 ecosystem.
Vulnerability Detail
The vulnerability (CVE-2021-32027) in PostgreSQL is caused by a buffer overrun from an integer overflow in array subscripting calculations. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service. Another vulnerability (CVE-2021-32028) in PostgreSQL allows for memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE statements, potentially exposing sensitive information. These vulnerabilities have been rated as important.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update postgresql-
< 9.6.22-1.module_el8.4.0+2479+beebcf7e9.6.22-1.module_el8.4.0+2479+beebcf7e -
< 9.6.22-1.module_el8.4.0+2492+beebcf7e9.6.22-1.module_el8.4.0+2492+beebcf7e -
< 9.6.22-1.module_el8.5.0+58+524703879.6.22-1.module_el8.5.0+58+52470387
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for these vulnerabilities at this time.
Conclusion
In conclusion, it is important to update the PostgreSQL package to the latest version to mitigate the risk of these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for postgresql →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) used for storing and managing large amounts of data.
These vulnerabilities can lead to memory corruption, arbitrary code execution, denial of service, and potential exposure of sensitive information.
To fix these vulnerabilities, update the PostgreSQL package to version 9.6.22-1.module_el8.4.0+2492+beebcf7e or later.
There are no known workarounds for these vulnerabilities at this time.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
