(RHSA-2024:6020) Important: postgresql:15 security update

2024-08-2910:26:34

access.redhat.com

postgresql

security fix

cve-2024-7348

cve-2024-4317

cvss score

unix

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

JSON

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348)
postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

OSVersionArchitecturePackageVersionFilename
RedHatanys390xpg_repack-debugsource< 1.4.8-1.module+el9.2.0+17405+aeb9ec60pg_repack-debugsource-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x.rpm
RedHatanys390xpostgresql-pltcl-debuginfo< 15.8-1.module+el9.4.0+22208+cd6b92ffpostgresql-pltcl-debuginfo-15.8-1.module+el9.4.0+22208+cd6b92ff.s390x.rpm
RedHatanyaarch64pg_repack-debugsource< 1.4.8-1.module+el9.2.0+17405+aeb9ec60pg_repack-debugsource-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64.rpm
RedHatanyaarch64postgresql-plpython3-debuginfo< 15.8-1.module+el9.4.0+22208+cd6b92ffpostgresql-plpython3-debuginfo-15.8-1.module+el9.4.0+22208+cd6b92ff.aarch64.rpm
RedHatanys390xpostgresql-test< 15.8-1.module+el9.4.0+22208+cd6b92ffpostgresql-test-15.8-1.module+el9.4.0+22208+cd6b92ff.s390x.rpm
RedHatanyppc64lepostgresql-pltcl-debuginfo< 15.8-1.module+el9.4.0+22208+cd6b92ffpostgresql-pltcl-debuginfo-15.8-1.module+el9.4.0+22208+cd6b92ff.ppc64le.rpm
RedHatanyx86_64postgresql-private-libs-debuginfo< 15.8-1.module+el9.4.0+22208+cd6b92ffpostgresql-private-libs-debuginfo-15.8-1.module+el9.4.0+22208+cd6b92ff.x86_64.rpm
RedHatanyppc64lepostgresql-test-debuginfo< 15.8-1.module+el9.4.0+22208+cd6b92ffpostgresql-test-debuginfo-15.8-1.module+el9.4.0+22208+cd6b92ff.ppc64le.rpm
RedHatanyppc64lepgaudit< 1.7.0-1.module+el9.2.0+17405+aeb9ec60pgaudit-1.7.0-1.module+el9.2.0+17405+aeb9ec60.ppc64le.rpm
RedHatanyaarch64postgresql-pltcl< 15.8-1.module+el9.4.0+22208+cd6b92ffpostgresql-pltcl-15.8-1.module+el9.4.0+22208+cd6b92ff.aarch64.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	any	s390x	pg_repack-debugsource	< 1.4.8-1.module+el9.2.0+17405+aeb9ec60	pg_repack-debugsource-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x.rpm
RedHat	any	s390x	postgresql-pltcl-debuginfo	< 15.8-1.module+el9.4.0+22208+cd6b92ff	postgresql-pltcl-debuginfo-15.8-1.module+el9.4.0+22208+cd6b92ff.s390x.rpm
RedHat	any	aarch64	pg_repack-debugsource	< 1.4.8-1.module+el9.2.0+17405+aeb9ec60	pg_repack-debugsource-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64.rpm
RedHat	any	aarch64	postgresql-plpython3-debuginfo	< 15.8-1.module+el9.4.0+22208+cd6b92ff	postgresql-plpython3-debuginfo-15.8-1.module+el9.4.0+22208+cd6b92ff.aarch64.rpm
RedHat	any	s390x	postgresql-test	< 15.8-1.module+el9.4.0+22208+cd6b92ff	postgresql-test-15.8-1.module+el9.4.0+22208+cd6b92ff.s390x.rpm
RedHat	any	ppc64le	postgresql-pltcl-debuginfo	< 15.8-1.module+el9.4.0+22208+cd6b92ff	postgresql-pltcl-debuginfo-15.8-1.module+el9.4.0+22208+cd6b92ff.ppc64le.rpm
RedHat	any	x86_64	postgresql-private-libs-debuginfo	< 15.8-1.module+el9.4.0+22208+cd6b92ff	postgresql-private-libs-debuginfo-15.8-1.module+el9.4.0+22208+cd6b92ff.x86_64.rpm
RedHat	any	ppc64le	postgresql-test-debuginfo	< 15.8-1.module+el9.4.0+22208+cd6b92ff	postgresql-test-debuginfo-15.8-1.module+el9.4.0+22208+cd6b92ff.ppc64le.rpm
RedHat	any	ppc64le	pgaudit	< 1.7.0-1.module+el9.2.0+17405+aeb9ec60	pgaudit-1.7.0-1.module+el9.2.0+17405+aeb9ec60.ppc64le.rpm
RedHat	any	aarch64	postgresql-pltcl	< 15.8-1.module+el9.4.0+22208+cd6b92ff	postgresql-pltcl-15.8-1.module+el9.4.0+22208+cd6b92ff.aarch64.rpm