USN-6570-1: PostgreSQL vulnerabilities
9 January 2024
Several security issues were fixed in PostgreSQL.
Releases
Packages
- postgresql-9.5 - Object-relational SQL database
Details
Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)
Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signal certain superuser processes,
contrary to expectations. (CVE-2023-5870)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
postgresql-9.5
-
9.5.25-0ubuntu0.16.04.1+esm6
Available with Ubuntu Pro
-
postgresql-client-9.5
-
9.5.25-0ubuntu0.16.04.1+esm6
Available with Ubuntu Pro
After a standard system update you need to restart PostgreSQL to make
all the necessary changes.
References
Related notices
- USN-6538-1: postgresql-plpython3-14, postgresql-plpython3-12, postgresql-doc-14, postgresql-client-14, postgresql-plperl-14, postgresql-server-dev-15, postgresql-plperl-15, postgresql-doc-12, postgresql-server-dev-12, libecpg-compat3, postgresql-client-12, postgresql-pltcl-15, libpq-dev, postgresql-15, postgresql-doc-15, postgresql-pltcl-12, libpgtypes3, postgresql-plpython3-15, postgresql-12, postgresql-client-15, libecpg-dev, postgresql-server-dev-14, postgresql-pltcl-14, libecpg6, postgresql-14, libpq5, postgresql-plperl-12
- USN-6538-2: libecpg-dev, postgresql-doc-10, postgresql-pltcl-10, libecpg-compat3, libpq-dev, postgresql-plpython-10, postgresql-plpython3-10, postgresql-plperl-10, libecpg6, libpgtypes3, libpq5, postgresql-server-dev-10, postgresql-10, postgresql-client-10