USN-5645-1: PostgreSQL vulnerabilities
28 September 2022
Several security issues were fixed in PostgreSQL.
Releases
Packages
- postgresql-9.5 - Object-relational SQL database
Details
Jacob Champion discovered that PostgreSQL incorrectly handled SSL
certificate verification and encryption. A remote attacker could possibly
use this issue to inject arbitrary SQL queries when a connection is first
established. (CVE-2021-23214)
Tom Lane discovered that PostgreSQL incorrect handled certain array
subscripting calculations. An authenticated attacker could possibly use
this issue to overwrite server memory and escalate privileges.
(CVE-2021-32027)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
postgresql-9.5
-
9.5.25-0ubuntu0.16.04.1+esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-5145-1: postgresql-server-dev-10, postgresql-doc-10, postgresql-client-13, postgresql-plperl-10, postgresql-doc-13, postgresql-plperl-13, postgresql-pltcl-13, postgresql-plpython3-13, postgresql-plpython3-10, postgresql-client-10, postgresql-plpython3-12, libecpg-dev, postgresql-plperl-12, postgresql-doc-12, postgresql-server-dev-13, postgresql-pltcl-10, libpq5, postgresql-client-12, postgresql-13, libecpg-compat3, libpq-dev, postgresql-plpython-10, postgresql-pltcl-12, libecpg6, postgresql-12, postgresql-server-dev-12, libpgtypes3, postgresql-10
- USN-4972-1: postgresql-server-dev-10, postgresql-doc-10, postgresql-client-13, postgresql-plperl-10, postgresql-doc-13, postgresql-plperl-13, postgresql-pltcl-13, postgresql-plpython3-13, postgresql-plpython3-10, postgresql-client-10, postgresql-plpython3-12, libecpg-dev, postgresql-plperl-12, postgresql-doc-12, postgresql-server-dev-13, postgresql-pltcl-10, libpq5, postgresql-client-12, postgresql-13, libecpg-compat3, libpq-dev, postgresql-plpython-10, postgresql-pltcl-12, libecpg6, postgresql-12, postgresql-server-dev-12, libpgtypes3, postgresql-10