Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2454: This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. Database owners have that right by default, and explicit grants may extend it to other users.
Fixed packages 30
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | postgresql15 | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-contrib | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-contrib-debuginfo | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-debuginfo | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-debugsource | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-docs | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-docs-debuginfo | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-llvmjit | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-llvmjit-debuginfo | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-plperl | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-plperl-debuginfo | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-plpython3 | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-plpython3-debuginfo | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-pltcl | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-pltcl-debuginfo | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-private-devel | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-private-libs | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-private-libs-debuginfo | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-server | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-server-debuginfo | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-server-devel | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-server-devel-debuginfo | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-static | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-test | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-test-debuginfo | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-test-rpm-macros | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-upgrade | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-upgrade-debuginfo | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-upgrade-devel | 0:15.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | postgresql15-upgrade-devel-debuginfo | 0:15.0-1.amzn2023.0.3 |
Vulnerabilities 1
-
High 7.2
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could per…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-2454.html