USN-6538-2: PostgreSQL vulnerabilities
17 January 2024
Several security issues were fixed in PostgreSQL.
Releases
Packages
- postgresql-10 - Object-relational SQL database
Details
USN-6538-1 fixed several vulnerabilities in PostgreSQL. This update provides
the corresponding updates for Ubuntu 18.04 LTS.
Original advisory details:
Jingzhou Fu discovered that PostgreSQL incorrectly handled certain unknown
arguments in aggregate function calls. A remote attacker could possibly use
this issue to obtain sensitive information. (CVE-2023-5868)
Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)
Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signal certain superuser processes,
contrary to expectations. (CVE-2023-5870)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 18.04
-
postgresql-10
-
10.23-0ubuntu0.18.04.2+esm1
Available with Ubuntu Pro
-
postgresql-client-10
-
10.23-0ubuntu0.18.04.2+esm1
Available with Ubuntu Pro
After a standard system update you need to restart PostgreSQL to make all
the necessary changes.
References
Related notices
- USN-6538-1: postgresql-pltcl-14, postgresql-doc-15, postgresql-client-14, postgresql-server-dev-14, libecpg-compat3, postgresql-plpython3-15, postgresql-plperl-15, postgresql-client-12, postgresql-plperl-12, postgresql-doc-12, libpgtypes3, libpq5, libpq-dev, postgresql-12, postgresql-pltcl-12, postgresql-plpython3-12, postgresql-plpython3-14, postgresql-doc-14, postgresql-client-15, postgresql-plperl-14, postgresql-server-dev-15, postgresql-server-dev-12, libecpg-dev, libecpg6, postgresql-15, postgresql-pltcl-15, postgresql-14
- USN-6570-1: postgresql-9.5, libecpg-dev, postgresql-plpython3-9.5, libecpg6, libpq5, postgresql-server-dev-9.5, libpq-dev, postgresql-doc-9.5, postgresql-pltcl-9.5, postgresql-plperl-9.5, postgresql-client-9.5, postgresql-contrib-9.5, postgresql-plpython-9.5, libpgtypes3, libecpg-compat3