Ubuntu 22.04 LTS: USN-5440-1 Critical Command Exec in PostgreSQL

ubuntu

May 24, 2022

PostgreSQL could be made to execute commands as the superuser.

Summary

PostgreSQL could be made to execute commands as the superuser.

Software Description:

- postgresql-14: Object-relational SQL database

- postgresql-13: Object-relational SQL database

- postgresql-12: Object-relational SQL database

- postgresql-10: Object-relational SQL database

Details:

Alexander Lakhin discovered that PostgreSQL incorrectly handled the

security restricted operation sandbox when a privileged user is maintaining

another user's objects. An attacker having permission to create non-temp

objects can use this issue to execute arbitrary commands as the superuser.

Topics Covered

security advisory update critical command execution Ubuntu software issue PostgreSQL

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
  postgresql-14                   14.3-0ubuntu0.22.04.1

Ubuntu 21.10:
  postgresql-13                   13.7-0ubuntu0.21.10.1

Ubuntu 20.04 LTS:
  postgresql-12                   12.11-0ubuntu0.20.04.1

Ubuntu 18.04 LTS:
  postgresql-10                   10.21-0ubuntu0.18.04.1

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.