Red Hat Security AdvisoryRHSA-2023:7785
postgresql:15 security update
Released 2023-12-13 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47
Fixes 5 records
Priority MEDIUM 47
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.04322 · Published 2023-12-10 · Partial fix · 4.2.4-6, 4.2.4-7 +29 CWE-190
Priority MEDIUM 43
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or "").
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01676 · Published 2023-08-11 · Partial fix · 4.2.4-6, 4.2.4-7 +21 CWE-89
Priority LOW 31
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.02775 · Published 2023-12-10 · Partial fix · 4.2.4-6, 4.2.4-7 +21 CWE-686
Priority LOW 25
A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher.
CVSS 3.1MEDIUM 4.4· Network · High privileges · No interaction · EPSS 0.02555 · Published 2023-12-10 · Partial fix · 4.2.4-6, 4.2.4-7 +21 CWE-400
Priority LOW 22
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.01086 · Published 2023-08-11 · Fixed in 8090020231114113548.a75119d5, 8080020231113134015.63b34585 +2 CWE-1220
THREATIST.IORead the docs