USN-6296-1: PostgreSQL vulnerabilities

Releases

• Ubuntu 23.04
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• postgresql-12 - Object-relational SQL database
• postgresql-14 - Object-relational SQL database
• postgresql-15 - Object-relational SQL database

Details

It was discovered that PostgreSQL incorrectly handled certain extension
script substitutions. An attacker having database-level CREATE privileges
can use this issue to execute arbitrary code as the bootstrap superuser.
(CVE-2023-39417)

It was discovered that PostgreSQL incorrectly handled the MERGE command. A
remote attacker could possibly use this issue to bypass certain UPDATE and
SELECT policies. This issue only affected Ubuntu 23.04. (CVE-2023-39418)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.04

• postgresql-15 - 15.4-0ubuntu0.23.04.1
• postgresql-client-15 - 15.4-0ubuntu0.23.04.1

Ubuntu 22.04

• postgresql-14 - 14.9-0ubuntu0.22.04.1
• postgresql-client-14 - 14.9-0ubuntu0.22.04.1

Ubuntu 20.04

• postgresql-12 - 12.16-0ubuntu0.20.04.1
• postgresql-client-12 - 12.16-0ubuntu0.20.04.1

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.

References

• CVE-2023-39417
• CVE-2023-39418

Related notices

• USN-6366-1: postgresql-9.5, postgresql-pltcl-9.5, libecpg6, postgresql-client-9.5, libpq-dev, postgresql-plpython3-9.5, postgresql-plperl-9.5, libecpg-dev, libpgtypes3, postgresql-doc-9.5, postgresql-server-dev-9.5, postgresql-contrib-9.5, postgresql-plpython-9.5, libpq5, libecpg-compat3