Security Update for postgresql-11
Summary
DSA-5135-1: postgresql-11 - security update. Affects postgresql-11 versions < 11.16-0+deb10u1. Fixed in 11.16-0+deb10u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an open-source relational database management system known for its robustness, scalability, and extensibility. It provides a wide range of features and is widely used in various applications and industries. The vulnerability in question affects the autovacuum feature and multiple commands in PostgreSQL 11, which could allow for an escape from the "security-restricted operation" sandbox.
Vulnerability Detail
The vulnerability, identified as CVE-2022-1552, allows an attacker to bypass the security restrictions imposed by the sandbox in PostgreSQL 11. This could potentially lead to unauthorized access, privilege escalation, or other malicious activities. The issue has been addressed by the PostgreSQL community, and a security update is available to fix the vulnerability.
How To Fix
Minimum fixed version
11.16-0+deb10u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade postgresql-11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. It is advised to apply the security update as soon as possible to mitigate the risk.
Conclusion
In conclusion, the vulnerability in postgresql-11 allows for an escape from the "security-restricted operation" sandbox, potentially leading to unauthorized access or privilege escalation. It is crucial to apply the provided security update to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for postgresql-11 →
FAQ
PostgreSQL is an open-source relational database management system known for its robustness, scalability, and extensibility. It provides a wide range of features and is widely used in various applications and industries.
The vulnerability allows for an escape from the "security-restricted operation" sandbox in PostgreSQL 11, which could potentially lead to unauthorized access, privilege escalation, or other malicious activities.
To fix the vulnerability, it is recommended to upgrade the postgresql-11 package to version 11.16-0+deb10u1 or later. This can be done by following the official documentation provided by the PostgreSQL community or by using package management tools specific to your operating system.
No specific workaround has been mentioned for this vulnerability. It is advised to apply the security update as soon as possible to mitigate the risk.
For more information about this vulnerability, you can refer to the upstream announcement at https://www.postgresql.org/support/security/CVE-2022-1552/
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-11.
