Summary
Alexander Lakhin discovered that PostgreSQL incorrectly handled the
security restricted operation sandbox when a privileged user is maintaining
another user's objects. An attacker having permission to create non-temp
objects can use this issue to execute arbitrary commands as the superuser.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | postgresql-10 | 10.21-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | postgresql-12 | 12.11-0ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | postgresql-14 | 14.3-0ubuntu0.22.04.1 |
Vulnerabilities 1
-
Unscored —CVE-2022-1552 EPSS 17%
A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is m…
References
-
report
https://ubuntu.com/security/CVE-2022-1552