Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 516
Alerts This Week
Warning Icon 1 516

Ubuntu 19.04: 4090-1 Critical: PostgreSQL Security Issues

ubuntu
Calendar Grey August 8, 2019
Dist Ubuntu Esm H88
Recent updates have addressed PostgreSQL security vulnerabilities for Ubuntu 18.04, 16.04, and 19.04. Promptly apply these patches for system integrity and security
Several security issues were fixed in PostgreSQL.

Summary

Several security issues were fixed in PostgreSQL.

Software Description:

- postgresql-11: Object-relational SQL database

- postgresql-10: Object-relational SQL database

- postgresql-9.5: Object-relational SQL database

Details:

Tom Lane discovered that PostgreSQL did not properly restrict

functions declared as "SECURITY DEFINER". An attacker could use this

to execute arbitrary SQL with the permissions of the function owner.

(CVE-2019-10208)

Andreas Seltenreich discovered that PostgreSQL did not properly handle

user-defined hash equality operators. An attacker could use this to

expose sensitive information (arbitrary PostgreSQL server memory). This

issue only affected Ubuntu 19.04. (CVE-2019-10209)

Topics%20covered

Topics Covered

security advisory access control Ubuntu update instructions information disclosure PostgreSQL

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
  postgresql-11                   11.5-0ubuntu0.19.04.1

Ubuntu 18.04 LTS:
  postgresql-10                   10.10-0ubuntu0.18.04.1

Ubuntu 16.04 LTS:
  postgresql-9.5                  9.5.19-0ubuntu0.16.04.1

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4090-1

CVE-2019-10208, CVE-2019-10209

Severity
critical
Lowest
Low
Medium
High
Critical

August 09, 2019

Topics%20covered

Topics Covered

security advisory access control Ubuntu update instructions information disclosure PostgreSQL

Package Information

https://launchpad.net/ubuntu/+source/postgresql-11/11.5-0ubuntu0.19.04.1
https://launchpad.net/ubuntu/+source/postgresql-10/10.10-0ubuntu0.18.04.1
https://launchpad.net/ubuntu/+source/postgresql-9.5/9.5.19-0ubuntu0.16.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.