Red Hat Security Advisory

RHSA-2023:4535

postgresql:12 security update

Released 2023-08-08 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.s390x::postgresql:12 +47

Fixes 3 records

TI-2023-02306 CVE-2023-2454 · GHSA-9fff-w5w3-5x9g

Improper input validation in postgresql

LOW 36

schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01199 Published 2023-06-09 Partial fix CWE-20

TI-2023-02307 CVE-2023-2455 · GHSA-r7p3-79xh-j7pg

Improper input validation in postgresql

LOW 26

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.007 Published 2023-06-09 Partial fix CWE-20

TI-2022-20211 CVE-2022-41862 · GHSA-fr68-cm8v-7vv6

Information disclosure in postgresql

LOW 19

In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00622 Published 2023-03-03 Partial fix CWE-200