Moderate: postgresql:10 security update
Summary
ALSA-2023:4539: Moderate: postgresql:10 security update. Affects postgresql versions < 10.23-2.module_el8.8.0+3599+77865fc6. Fixed in 10.23-2.module_el8.8.0+3599+77865fc6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PostgreSQL is an advanced object-relational database management system (DBMS). It provides a robust and scalable solution for storing and managing structured data. PostgreSQL is widely used in various applications and industries due to its reliability and extensive feature set.
Vulnerability Detail
The vulnerability (CVE-2023-2454) in PostgreSQL allows an attacker to bypass protective search_path changes using the schema_element function. This can lead to unauthorized access and potential data leakage. Another vulnerability (CVE-2023-2455) in PostgreSQL's row security policies allows an attacker to disregard user ID changes after inlining, potentially bypassing security measures.
How To Fix
Minimum fixed version
10.23-2.module_el8.8.0+3599+77865fc6
This is the first release that contains the fix.
sudo dnf update postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the security update as soon as possible.
Conclusion
PostgreSQL version 10 is affected by two security vulnerabilities (CVE-2023-2454 and CVE-2023-2455). To ensure the security of your PostgreSQL installation, it is crucial to update to version 10.23-2.module_el8.8.0+3599+77865fc6 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for postgresql →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) known for its reliability and extensive feature set.
The vulnerability allows an attacker to bypass protective search_path changes and row security policies, potentially leading to unauthorized access and data leakage.
To fix the vulnerability, update PostgreSQL to version 10.23-2.module_el8.8.0+3599+77865fc6 or later.
There are no specific workarounds mentioned for this vulnerability. It is recommended to apply the security update.
You can find more information about the vulnerability in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
