Lucene search

K
redhatRedHatRHSA-2023:7579
HistoryNov 29, 2023 - 1:49 p.m.

(RHSA-2023:7579) Important: postgresql:13 security update

2023-11-2913:49:39
access.redhat.com
16
postgresql
security fix
buffer overrun
memory disclosure
sql injection
role pg_signal_backend
cve-2023-5869
cve-2023-5868
cve-2023-39417
cve-2023-5870

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.015

Percentile

87.0%

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

  • postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

  • postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)

  • postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

  • postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
RedHatanyx86_64postgresql-plpython3-debuginfo< 13.13-1.module+el8.8.0+20662+3e7b23d2postgresql-plpython3-debuginfo-13.13-1.module+el8.8.0+20662+3e7b23d2.x86_64.rpm
RedHatanyaarch64postgresql-pltcl-debuginfo< 13.13-1.module+el8.8.0+20662+3e7b23d2postgresql-pltcl-debuginfo-13.13-1.module+el8.8.0+20662+3e7b23d2.aarch64.rpm
RedHatanyx86_64postgresql-debugsource< 13.13-1.module+el8.8.0+20662+3e7b23d2postgresql-debugsource-13.13-1.module+el8.8.0+20662+3e7b23d2.x86_64.rpm
RedHatanyaarch64pgaudit< 1.5.0-1.module+el8.4.0+8873+b821c30apgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.aarch64.rpm
RedHatanyx86_64postgresql-upgrade< 13.13-1.module+el8.8.0+20662+3e7b23d2postgresql-upgrade-13.13-1.module+el8.8.0+20662+3e7b23d2.x86_64.rpm
RedHatanyaarch64postgresql-static< 13.13-1.module+el8.8.0+20662+3e7b23d2postgresql-static-13.13-1.module+el8.8.0+20662+3e7b23d2.aarch64.rpm
RedHatanys390xpostgresql-server-debuginfo< 13.13-1.module+el8.8.0+20662+3e7b23d2postgresql-server-debuginfo-13.13-1.module+el8.8.0+20662+3e7b23d2.s390x.rpm
RedHatanyppc64lepostgresql-upgrade-devel-debuginfo< 13.13-1.module+el8.8.0+20662+3e7b23d2postgresql-upgrade-devel-debuginfo-13.13-1.module+el8.8.0+20662+3e7b23d2.ppc64le.rpm
RedHatanyaarch64postgres-decoderbufs< 0.10.0-2.module+el8.4.0+8873+b821c30apostgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.aarch64.rpm
RedHatanyaarch64postgresql-test< 13.13-1.module+el8.8.0+20662+3e7b23d2postgresql-test-13.13-1.module+el8.8.0+20662+3e7b23d2.aarch64.rpm
Rows per page:
1-10 of 1331

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.015

Percentile

87.0%