Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5869: While modifying certain SQL array values, missing overflow checks let authenticated database users write arbitrary bytes to a memory area that facilitates arbitrary code execution. Missing overflow checks also let authenticated database users read a wide area of server memory. The CVE-2021-32027 fix covered some attacks of this description, but it missed others.
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | postgresql | 0:9.2.24-8.amzn2.0.3 |
| Amazon Linux · 2 | postgresql-contrib | 0:9.2.24-8.amzn2.0.3 |
| Amazon Linux · 2 | postgresql-debuginfo | 0:9.2.24-8.amzn2.0.3 |
| Amazon Linux · 2 | postgresql-devel | 0:9.2.24-8.amzn2.0.3 |
| Amazon Linux · 2 | postgresql-docs | 0:9.2.24-8.amzn2.0.3 |
| Amazon Linux · 2 | postgresql-libs | 0:9.2.24-8.amzn2.0.3 |
| Amazon Linux · 2 | postgresql-plperl | 0:9.2.24-8.amzn2.0.3 |
| Amazon Linux · 2 | postgresql-plpython | 0:9.2.24-8.amzn2.0.3 |
| Amazon Linux · 2 | postgresql-pltcl | 0:9.2.24-8.amzn2.0.3 |
| Amazon Linux · 2 | postgresql-server | 0:9.2.24-8.amzn2.0.3 |
| Amazon Linux · 2 | postgresql-static | 0:9.2.24-8.amzn2.0.3 |
| Amazon Linux · 2 | postgresql-test | 0:9.2.24-8.amzn2.0.3 |
| Amazon Linux · 2 | postgresql-upgrade | 0:9.2.24-8.amzn2.0.3 |
Vulnerabilities 1
-
High 8.8
Postgresql: buffer overrun from integer overflow in array modification
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user c…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-5869.html