Medium ELSA-2023-4535 3 CVEs

Moderate: postgresql:12 security update (Oracle Linux 8)

Published Aug 10, 2023 · Updated Aug 10, 2023

Ecosystem: Oracle Linux

Summary

pgaudit
pg_repack
postgres-decoderbufs

postgresql
[12.15-1.0.1]
- Fixed postgresql port binding issue during bootup [Orabug: 35103668]

[12.15-1]
- Update postgresql-setup to 8.7 (https://github.com/devexp-db/postgresql-setup/pull/35)
- Resolves: #2207932
- Update to version 12.15

Fixed packages 16

Release	Package	Fixed in
Oracle Linux · 8	pg_repack	0:1.4.6-3.module+el8.5.0+20333+86306fc7
Oracle Linux · 8	pgaudit	0:1.4.0-5.module+el8.5.0+20333+86306fc7
Oracle Linux · 8	postgres-decoderbufs	0:0.10.0-2.module+el8.5.0+20333+86306fc7
Oracle Linux · 8	postgresql	0:12.15-1.0.1.module+el8.8.0+21142+0a9e8b30
Oracle Linux · 8	postgresql-contrib	0:12.15-1.0.1.module+el8.8.0+21142+0a9e8b30
Oracle Linux · 8	postgresql-docs	0:12.15-1.0.1.module+el8.8.0+21142+0a9e8b30
Oracle Linux · 8	postgresql-plperl	0:12.15-1.0.1.module+el8.8.0+21142+0a9e8b30
Oracle Linux · 8	postgresql-plpython3	0:12.15-1.0.1.module+el8.8.0+21142+0a9e8b30
Oracle Linux · 8	postgresql-pltcl	0:12.15-1.0.1.module+el8.8.0+21142+0a9e8b30
Oracle Linux · 8	postgresql-server	0:12.15-1.0.1.module+el8.8.0+21142+0a9e8b30
Oracle Linux · 8	postgresql-server-devel	0:12.15-1.0.1.module+el8.8.0+21142+0a9e8b30
Oracle Linux · 8	postgresql-static	0:12.15-1.0.1.module+el8.8.0+21142+0a9e8b30
Oracle Linux · 8	postgresql-test	0:12.15-1.0.1.module+el8.8.0+21142+0a9e8b30
Oracle Linux · 8	postgresql-test-rpm-macros	0:12.15-1.0.1.module+el8.8.0+21142+0a9e8b30
Oracle Linux · 8	postgresql-upgrade	0:12.15-1.0.1.module+el8.8.0+21142+0a9e8b30
Oracle Linux · 8	postgresql-upgrade-devel	0:12.15-1.0.1.module+el8.8.0+21142+0a9e8b30

Vulnerabilities 3

High 7.2

CVE-2023-2454

schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could per…

postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Alpine

Jun 9, 2023
Medium 5.4

CVE-2023-2455

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applie…

postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Alpine

Jun 9, 2023
Low 3.7

CVE-2022-41862

In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos …

postgresql15 postgresql-12 postgresql-14 postgresql-15 Debian Ubuntu Alpine Wolfi

Mar 3, 2023