Moderate: postgresql security update
Summary
ALSA-2023:1693: Moderate: postgresql security update. Affects postgresql versions < 13.10-1.el9_1. Fixed in 13.10-1.el9_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS). It is widely used for storing and managing structured data in various applications. PostgreSQL provides a rich set of features and is known for its reliability, scalability, and extensibility.
Vulnerability Detail
The vulnerability (CVE-2022-2625) in PostgreSQL allows extension scripts to replace objects that do not belong to the extension. This can lead to unauthorized access, data corruption, or privilege escalation. Another vulnerability (CVE-2022-41862) allows a client to disclose memory when connecting with Kerberos to a modified server. An attacker could exploit this to obtain sensitive information from the server's memory.
How To Fix
Minimum fixed version
13.10-1.el9_1
This is the first release that contains the fix.
sudo dnf update postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. It is advised to apply the security update as soon as possible to mitigate the risk.
Conclusion
PostgreSQL has released a security update to address the identified vulnerabilities. It is important to update PostgreSQL to the latest version to protect against potential exploits. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for postgresql →
FAQ
PostgreSQL is an advanced object-relational database management system (DBMS) known for its reliability, scalability, and extensibility.
CVE-2022-2625 allows extension scripts to replace objects not belonging to the extension, which can lead to unauthorized access, data corruption, or privilege escalation.
CVE-2022-41862 allows a client to disclose memory when connecting with Kerberos to a modified server, potentially exposing sensitive information from the server's memory.
To fix the vulnerability, update PostgreSQL to version 13.10-1.el9_1 or later.
There are no specific workarounds mentioned for this vulnerability. It is recommended to apply the security update.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
