USN-6538-2: PostgreSQL vulnerabilities
17 January 2024
Several security issues were fixed in PostgreSQL.
Releases
Packages
- postgresql-10 - Object-relational SQL database
Details
USN-6538-1 fixed several vulnerabilities in PostgreSQL. This update provides
the corresponding updates for Ubuntu 18.04 LTS.
Original advisory details:
Jingzhou Fu discovered that PostgreSQL incorrectly handled certain unknown
arguments in aggregate function calls. A remote attacker could possibly use
this issue to obtain sensitive information. (CVE-2023-5868)
Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)
Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signal certain superuser processes,
contrary to expectations. (CVE-2023-5870)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 18.04
-
postgresql-10
-
10.23-0ubuntu0.18.04.2+esm1
Available with Ubuntu Pro
-
postgresql-client-10
-
10.23-0ubuntu0.18.04.2+esm1
Available with Ubuntu Pro
After a standard system update you need to restart PostgreSQL to make all
the necessary changes.
References
Related notices
- USN-6538-1: libpq-dev, postgresql-client-12, postgresql-pltcl-12, postgresql-pltcl-14, libecpg-compat3, postgresql-12, libecpg6, postgresql-plpython3-14, postgresql-plpython3-12, postgresql-server-dev-12, postgresql-doc-12, postgresql-plperl-12, postgresql-doc-14, postgresql-server-dev-14, postgresql-15, postgresql-plpython3-15, libecpg-dev, libpgtypes3, postgresql-pltcl-15, postgresql-doc-15, postgresql-client-14, libpq5, postgresql-client-15, postgresql-server-dev-15, postgresql-plperl-14, postgresql-14, postgresql-plperl-15
- USN-6570-1: postgresql-plpython-9.5, postgresql-client-9.5, libpq-dev, postgresql-plperl-9.5, postgresql-plpython3-9.5, postgresql-contrib-9.5, libecpg-dev, postgresql-9.5, libpgtypes3, postgresql-pltcl-9.5, postgresql-server-dev-9.5, postgresql-doc-9.5, libecpg-compat3, libpq5, libecpg6