Important: postgresql:16 security update
Summary
ALSA-2024:5929: Important: postgresql:16 security update. Affects pg_repack versions < 1.4.8-1.module_el9.4.0+66+eb9878bc. Fixed in 1.4.8-1.module_el9.4.0+66+eb9878bc. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) that provides robust data storage and retrieval capabilities. It is widely used in various applications and industries for managing large volumes of structured data. PostgreSQL offers a range of features, including support for complex queries, data integrity, and transaction management.
Vulnerability Detail
The security update addresses two vulnerabilities in PostgreSQL:
-
CVE-2024-4317: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks. This vulnerability could allow an authenticated attacker to access or modify statistics data, potentially leading to unauthorized access or data manipulation.
-
CVE-2024-7348: PostgreSQL relation replacement during pg_dump executes arbitrary SQL. This vulnerability could allow an attacker with the ability to execute arbitrary SQL statements during a pg_dump operation to execute malicious SQL code, potentially leading to unauthorized access or data corruption.
How To Fix
Minimum fixed version
1.4.8-1.module_el9.4.0+66+eb9878bc
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is advised to apply the security update as soon as possible.
Conclusion
PostgreSQL has released a security update to address two vulnerabilities that could potentially lead to unauthorized access, data manipulation, or data corruption. It is crucial to update PostgreSQL to the recommended version to ensure the security and integrity of your database.
See every vulnerability recorded for pg_repack →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness and feature-rich capabilities.
The security update addresses two vulnerabilities: CVE-2024-4317 and CVE-2024-7348. These vulnerabilities involve lack of authorization checks and potential execution of arbitrary SQL code during pg_dump.
The lack of authorization checks in pg_stats_ext and pg_stats_ext_exprs could allow unauthorized access or data manipulation. The vulnerability related to relation replacement during pg_dump could lead to execution of malicious SQL code and potential unauthorized access or data corruption.
To fix the vulnerabilities, update PostgreSQL to version 16.4-1.module_el9.4.0+109+624ac33a or later.
There are no specific workarounds mentioned for these vulnerabilities. It is recommended to apply the security update.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
