USN-5645-1 — postgresql-9.5 vulnerabilities

Summary

Jacob Champion discovered that PostgreSQL incorrectly handled SSL
certificate verification and encryption. A remote attacker could possibly
use this issue to inject arbitrary SQL queries when a connection is first
established. (CVE-2021-23214)

Tom Lane discovered that PostgreSQL incorrect handled certain array
subscripting calculations. An authenticated attacker could possibly use
this issue to overwrite server memory and escalate privileges.
(CVE-2021-32027)

Fixed packages 1

Release	Package	Fixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	postgresql-9.5	9.5.25-0ubuntu0.16.04.1+esm1

Vulnerabilities 2

Unscored —

CVE-2021-23214

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, …

postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine

Mar 4, 2022
Unscored —

CVE-2021-32027

A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. Whil…

postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Alpine

Jun 1, 2021

References

report
https://ubuntu.com/security/CVE-2021-23214
report
https://ubuntu.com/security/CVE-2021-32027

postgresql-9.5 vulnerabilities

Summary

Fixed packages 1

Vulnerabilities 2

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, …

A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. Whil…

References