Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39417: IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
Fixed packages 30
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | postgresql15 | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-contrib | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-contrib-debuginfo | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-debuginfo | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-debugsource | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-docs | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-docs-debuginfo | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-llvmjit | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-llvmjit-debuginfo | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-plperl | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-plperl-debuginfo | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-plpython3 | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-plpython3-debuginfo | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-pltcl | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-pltcl-debuginfo | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-private-devel | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-private-libs | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-private-libs-debuginfo | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-server | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-server-debuginfo | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-server-devel | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-server-devel-debuginfo | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-static | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-test | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-test-debuginfo | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-test-rpm-macros | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-upgrade | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-upgrade-debuginfo | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-upgrade-devel | 0:15.0-1.amzn2023.0.4 |
| Amazon Linux · 2023 | postgresql15-upgrade-devel-debuginfo | 0:15.0-1.amzn2023.0.4 |
Vulnerabilities 1
-
High 7.5
Postgresql: extension script @substitutions@ within quoting allow sql injection
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-39417.html