[SECURITY] [DLA 3422-1] postgresql-11 security update

2023-05-1509:06:12

lists.debian.org

policy enforcement

postgresql-11

privilege escalation

debian 10 buster

security update

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.9%

JSON

Debian LTS Advisory DLA-3422-1 [email protected]
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
May 15, 2023 https://wiki.debian.org/LTS

Package : postgresql-11
Version : 11.20-0+deb10u1
CVE ID : CVE-2023-2454 CVE-2023-2455

Two security issues were found in PostgreSQL, which may result in
privilege escalation or incorrect policy enforcement.

For Debian 10 buster, these problems have been fixed in version
11.20-0+deb10u1.

We recommend that you upgrade your postgresql-11 packages.

For the detailed security status of postgresql-11 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/postgresql-11

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian11armelpostgresql-plpython3-13-dbgsym< 13.11-0+deb11u1postgresql-plpython3-13-dbgsym_13.11-0+deb11u1_armel.deb
Debian11armelpostgresql-server-dev-13< 13.11-0+deb11u1postgresql-server-dev-13_13.11-0+deb11u1_armel.deb
Debian11s390xpostgresql-plpython3-13< 13.11-0+deb11u1postgresql-plpython3-13_13.11-0+deb11u1_s390x.deb
Debian11arm64postgresql-server-dev-13< 13.11-0+deb11u1postgresql-server-dev-13_13.11-0+deb11u1_arm64.deb
Debian10arm64libecpg6< 11.20-0+deb10u1libecpg6_11.20-0+deb10u1_arm64.deb
Debian10arm64libpgtypes3< 11.20-0+deb10u1libpgtypes3_11.20-0+deb10u1_arm64.deb
Debian10arm64libpq-dev< 11.20-0+deb10u1libpq-dev_11.20-0+deb10u1_arm64.deb
Debian11i386libecpg6< 13.11-0+deb11u1libecpg6_13.11-0+deb11u1_i386.deb
Debian11mipselpostgresql-plperl-13< 13.11-0+deb11u1postgresql-plperl-13_13.11-0+deb11u1_mipsel.deb
Debian10armhfpostgresql-client-11< 11.20-0+deb10u1postgresql-client-11_11.20-0+deb10u1_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	armel	postgresql-plpython3-13-dbgsym	< 13.11-0+deb11u1	postgresql-plpython3-13-dbgsym_13.11-0+deb11u1_armel.deb
Debian	11	armel	postgresql-server-dev-13	< 13.11-0+deb11u1	postgresql-server-dev-13_13.11-0+deb11u1_armel.deb
Debian	11	s390x	postgresql-plpython3-13	< 13.11-0+deb11u1	postgresql-plpython3-13_13.11-0+deb11u1_s390x.deb
Debian	11	arm64	postgresql-server-dev-13	< 13.11-0+deb11u1	postgresql-server-dev-13_13.11-0+deb11u1_arm64.deb
Debian	10	arm64	libecpg6	< 11.20-0+deb10u1	libecpg6_11.20-0+deb10u1_arm64.deb
Debian	10	arm64	libpgtypes3	< 11.20-0+deb10u1	libpgtypes3_11.20-0+deb10u1_arm64.deb
Debian	10	arm64	libpq-dev	< 11.20-0+deb10u1	libpq-dev_11.20-0+deb10u1_arm64.deb
Debian	11	i386	libecpg6	< 13.11-0+deb11u1	libecpg6_13.11-0+deb11u1_i386.deb
Debian	11	mipsel	postgresql-plperl-13	< 13.11-0+deb11u1	postgresql-plperl-13_13.11-0+deb11u1_mipsel.deb
Debian	10	armhf	postgresql-client-11	< 11.20-0+deb10u1	postgresql-client-11_11.20-0+deb10u1_armhf.deb