Important: postgresql:15 security update
Summary
ALSA-2024:6020: Important: postgresql:15 security update. Affects pg_repack versions < 1.4.8-1.module_el9.3.0+52+21733919. Fixed in 1.4.8-1.module_el9.3.0+52+21733919. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) that provides robust data storage and retrieval capabilities. It is widely used in various applications and industries for managing large volumes of structured data. PostgreSQL offers a range of features including support for complex queries, data integrity, and extensibility through user-defined functions and types. However, it is susceptible to security vulnerabilities that can compromise the confidentiality, integrity, and availability of data stored in the database.
Vulnerability Detail
The PostgreSQL version 15 is affected by two security vulnerabilities:
-
CVE-2024-7348: This vulnerability allows an attacker to execute arbitrary SQL statements during the pg_dump process, which can lead to unauthorized access, data manipulation, or privilege escalation.
-
CVE-2024-4317: This vulnerability affects the pg_stats_ext and pg_stats_ext_exprs extensions in PostgreSQL, which lack proper authorization checks. An attacker with limited privileges can exploit this vulnerability to access sensitive information or perform unauthorized actions.
How To Fix
Minimum fixed version
1.4.8-1.module_el9.3.0+52+21733919
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
PostgreSQL version 15 is affected by two security vulnerabilities that can lead to unauthorized access, data manipulation, or privilege escalation. It is crucial to update PostgreSQL to the latest version (15.8-1.module_el9.4.0+111+667b9e9e or later) to mitigate these vulnerabilities and ensure the security of your database.
See every vulnerability recorded for pg_repack →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and support for complex queries.
CVE-2024-7348 allows an attacker to execute arbitrary SQL statements during the pg_dump process, potentially leading to unauthorized access, data manipulation, or privilege escalation.
CVE-2024-4317 affects the pg_stats_ext and pg_stats_ext_exprs extensions in PostgreSQL, enabling an attacker with limited privileges to access sensitive information or perform unauthorized actions.
To update PostgreSQL, follow the official documentation or consult your distribution's package manager for instructions on how to install the latest version (15.8-1.module_el9.4.0+111+667b9e9e or later).
No specific workarounds have been provided for these vulnerabilities. It is recommended to update PostgreSQL to the fixed version as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
