Red Hat Security Advisory: rh-postgresql13-postgresql security update

Fixed packages 16

Vulnerabilities 7

• High 8.8
  CVE-2023-5869

  Postgresql: buffer overrun from integer overflow in array modification

  A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user c…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Wolfi
  Dec 10, 2023
• High 7.5
  CVE-2023-39417

  Postgresql: extension script @substitutions@ within quoting allow sql injection

  IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Aug 11, 2023
• High 7.2
  CVE-2023-2454

  schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could per…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Alpine
  Jun 9, 2023
• Medium 5.4
  CVE-2023-2455

  Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applie…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Alpine
  Jun 9, 2023
• Medium 4.3
  CVE-2023-5868

  Postgresql: memory disclosure in aggregate function calls

  A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type d…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Wolfi
  Dec 10, 2023
• Low 3.7
  CVE-2022-41862

  In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos …

  postgresql15 postgresql-12 postgresql-14 postgresql-15 Debian Ubuntu Alpine Wolfi
  Mar 3, 2023
• Low 2.2
  CVE-2023-5870

  Postgresql: role pg_signal_backend can signal certain superuser processes.

  A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Wolfi
  Dec 10, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2165722
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2207568
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2207569
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2228111
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2247168
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2247169
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2247170
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7772.json
• report
  https://access.redhat.com/security/cve/CVE-2022-41862
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41862
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41862
• report
  https://access.redhat.com/security/cve/CVE-2023-2454
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-2454
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-2454
• article
  https://www.postgresql.org/about/news/postgresql-153-148-1311-1215-and-1120-released-2637/
• article
  https://www.postgresql.org/support/security/CVE-2023-2454/
• report
  https://access.redhat.com/security/cve/CVE-2023-2455
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-2455
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-2455
• report
  https://access.redhat.com/security/cve/CVE-2023-5868
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5868
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5868
• article
  https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/
• article
  https://www.postgresql.org/support/security/CVE-2023-5868/
• report
  https://access.redhat.com/security/cve/CVE-2023-5869
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5869
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5869
• article
  https://www.postgresql.org/support/security/CVE-2023-5869/
• report
  https://access.redhat.com/security/cve/CVE-2023-5870
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5870
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5870
• article
  https://www.postgresql.org/support/security/CVE-2023-5870/
• report
  https://access.redhat.com/security/cve/CVE-2023-39417
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39417
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39417
• article
  https://www.postgresql.org/support/security/CVE-2023-39417