USN-6570-1: PostgreSQL vulnerabilities
9 January 2024
Several security issues were fixed in PostgreSQL.
Releases
Packages
- postgresql-9.5 - Object-relational SQL database
Details
Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)
Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signal certain superuser processes,
contrary to expectations. (CVE-2023-5870)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
postgresql-9.5
-
9.5.25-0ubuntu0.16.04.1+esm6
Available with Ubuntu Pro
-
postgresql-client-9.5
-
9.5.25-0ubuntu0.16.04.1+esm6
Available with Ubuntu Pro
After a standard system update you need to restart PostgreSQL to make
all the necessary changes.
References
Related notices
- USN-6538-1: libpq-dev, postgresql-plperl-12, postgresql-client-14, libpgtypes3, libecpg-dev, postgresql-plperl-15, postgresql-doc-14, postgresql-12, libecpg-compat3, postgresql-15, libpq5, postgresql-14, postgresql-server-dev-12, postgresql-server-dev-14, postgresql-plpython3-12, postgresql-plpython3-15, postgresql-pltcl-12, postgresql-plperl-14, postgresql-client-12, libecpg6, postgresql-server-dev-15, postgresql-doc-15, postgresql-doc-12, postgresql-plpython3-14, postgresql-client-15, postgresql-pltcl-14, postgresql-pltcl-15
- USN-6538-2: postgresql-10, libecpg6, libpq-dev, libecpg-compat3, postgresql-plperl-10, libpq5, postgresql-client-10, libpgtypes3, libecpg-dev, postgresql-server-dev-10, postgresql-doc-10, postgresql-plpython3-10, postgresql-pltcl-10, postgresql-plpython-10