Red Hat Security AdvisoryRHSA-2023:7695
postgresql:13 security update
Released 2023-12-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
- Red Hat Enterprise Linux AppStream E4S (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.aarch64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.ppc64le::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.s390x::postgresql:13 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
Fixes 8 records
Priority MEDIUM 47
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.04322 · Published 2023-12-10 · Partial fix · 4.2.4-6, 4.2.4-7 +29 CWE-190
Priority MEDIUM 43
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or "").
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01676 · Published 2023-08-11 · Partial fix · 4.2.4-6, 4.2.4-7 +21 CWE-89
Priority MEDIUM 41
A vulnerability was found in PostgreSQL.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.02154 · Published 2022-08-18 · Partial fix CWE-915
Priority LOW 36
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01199 · Published 2023-06-09 · Partial fix CWE-20
Priority LOW 31
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.02775 · Published 2023-12-10 · Partial fix · 4.2.4-6, 4.2.4-7 +21 CWE-686
Priority LOW 26
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role…
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.007 · Published 2023-06-09 · Partial fix CWE-20
Priority LOW 25
A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher.
CVSS 3.1MEDIUM 4.4· Network · High privileges · No interaction · EPSS 0.02555 · Published 2023-12-10 · Partial fix · 4.2.4-6, 4.2.4-7 +21 CWE-400
Priority LOW 19
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00622 · Published 2023-03-03 · Partial fix CWE-200
THREATIST.IORead the docs