Moderate: postgresql:15 security update
Summary
ALSA-2023:4327: Moderate: postgresql:15 security update. Affects pg_repack versions < 1.4.8-1.module_el9.2.0+22+09653793. Fixed in 1.4.8-1.module_el9.2.0+22+09653793. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) used for storing and managing structured data. It provides a wide range of features and capabilities for efficient data storage, retrieval, and manipulation. PostgreSQL is widely used in various applications and industries due to its reliability, scalability, and extensibility.
Vulnerability Detail
The vulnerability (CVE-2023-2454) in PostgreSQL allows an attacker to bypass protective search_path changes using the schema_element function. This can lead to unauthorized access to sensitive data or the execution of arbitrary SQL commands. Another vulnerability (CVE-2023-2455) in PostgreSQL's row security policies allows an attacker to disregard user ID changes after inlining, potentially leading to privilege escalation or unauthorized data access.
How To Fix
Minimum fixed version
1.4.8-1.module_el9.2.0+22+09653793
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
Conclusion
PostgreSQL is a widely used database management system, and it is important to keep it updated with the latest security patches. The identified vulnerabilities can lead to unauthorized access to data or execution of arbitrary SQL commands. It is recommended to apply the provided security update to mitigate these risks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for pg_repack →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) used for storing and managing structured data.
These vulnerabilities can allow an attacker to bypass protective search_path changes, leading to unauthorized access to data or execution of arbitrary SQL commands. They can also result in privilege escalation or unauthorized data access.
To fix these vulnerabilities, update PostgreSQL to version 15.3-1.module_el9.2.0+32+f3c125b5 or later.
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
