Skip to content
OpenAdvisories
High ALAS2-2022-1843 3 CVEs

Important: postgresql security update (Amazon Linux 2)

Published Sep 1, 2022 · Updated May 23, 2024

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5869: While modifying certain SQL array values, missing overflow checks let authenticated database users write arbitrary bytes to a memory area that facilitates arbitrary code execution. Missing overflow checks also let authenticated database users read a wide area of server memory. The CVE-2021-32027 fix covered some attacks of this description, but it missed others. CVE-2022-1552: A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity. CVE-2021-32027: A flaw was found in postgresql. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Fixed packages 13

ReleasePackageFixed in
Amazon Linux · 2 postgresql 0:9.2.24-8.amzn2
Amazon Linux · 2 postgresql-contrib 0:9.2.24-8.amzn2
Amazon Linux · 2 postgresql-debuginfo 0:9.2.24-8.amzn2
Amazon Linux · 2 postgresql-devel 0:9.2.24-8.amzn2
Amazon Linux · 2 postgresql-docs 0:9.2.24-8.amzn2
Amazon Linux · 2 postgresql-libs 0:9.2.24-8.amzn2
Amazon Linux · 2 postgresql-plperl 0:9.2.24-8.amzn2
Amazon Linux · 2 postgresql-plpython 0:9.2.24-8.amzn2
Amazon Linux · 2 postgresql-pltcl 0:9.2.24-8.amzn2
Amazon Linux · 2 postgresql-server 0:9.2.24-8.amzn2
Amazon Linux · 2 postgresql-static 0:9.2.24-8.amzn2
Amazon Linux · 2 postgresql-test 0:9.2.24-8.amzn2
Amazon Linux · 2 postgresql-upgrade 0:9.2.24-8.amzn2

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-32027.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-1552.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-5869.html