Discover Government News

=========================================================================Ubuntu Security Notice USN-5440-1
May 24, 2022

postgresql-10, postgresql-12, postgresql-13, postgresql-14 vulnerability
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 21.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

PostgreSQL could be made to execute commands as the superuser.

Software Description:
- postgresql-14: Object-relational SQL database
- postgresql-13: Object-relational SQL database
- postgresql-12: Object-relational SQL database
- postgresql-10: Object-relational SQL database

Details:

Alexander Lakhin discovered that PostgreSQL incorrectly handled the
security restricted operation sandbox when a privileged user is maintaining
another user's objects. An attacker having permission to create non-temp
objects can use this issue to execute arbitrary commands as the superuser.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
  postgresql-14                   14.3-0ubuntu0.22.04.1

Ubuntu 21.10:
  postgresql-13                   13.7-0ubuntu0.21.10.1

Ubuntu 20.04 LTS:
  postgresql-12                   12.11-0ubuntu0.20.04.1

Ubuntu 18.04 LTS:
  postgresql-10                   10.21-0ubuntu0.18.04.1

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-5440-1
  CVE-2022-1552

Package Information:
  https://launchpad.net/ubuntu/+source/postgresql-14/14.3-0ubuntu0.22.04.1
  https://launchpad.net/ubuntu/+source/postgresql-13/13.7-0ubuntu0.21.10.1
  https://launchpad.net/ubuntu/+source/postgresql-12/12.11-0ubuntu0.20.04.1
  https://launchpad.net/ubuntu/+source/postgresql-10/10.21-0ubuntu0.18.04.1

Ubuntu 5440-1: PostgreSQL vulnerability

May 24, 2022
PostgreSQL could be made to execute commands as the superuser.

Summary

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS: postgresql-14 14.3-0ubuntu0.22.04.1 Ubuntu 21.10: postgresql-13 13.7-0ubuntu0.21.10.1 Ubuntu 20.04 LTS: postgresql-12 12.11-0ubuntu0.20.04.1 Ubuntu 18.04 LTS: postgresql-10 10.21-0ubuntu0.18.04.1 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart PostgreSQL to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5440-1

CVE-2022-1552

Severity
May 24, 2022

Package Information

https://launchpad.net/ubuntu/+source/postgresql-14/14.3-0ubuntu0.22.04.1 https://launchpad.net/ubuntu/+source/postgresql-13/13.7-0ubuntu0.21.10.1 https://launchpad.net/ubuntu/+source/postgresql-12/12.11-0ubuntu0.20.04.1 https://launchpad.net/ubuntu/+source/postgresql-10/10.21-0ubuntu0.18.04.1

Related News