Ubuntu 5571-1: PostgreSQL vulnerability | LinuxSecurity.com
==========================================================================
Ubuntu Security Notice USN-5571-1
August 18, 2022

postgresql-10, postgresql-12, postgresql-14 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

PostgreSQL could be made to run programs when creating or updating
extensions.

Software Description:
- postgresql-14: Object-relational SQL database
- postgresql-12: Object-relational SQL database
- postgresql-10: Object-relational SQL database

Details:

Sven Klemm discovered that PostgreSQL incorrectly handled extensions. An
attacker could possibly use this issue to execute arbitrary code when
extensions are created or updated.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
  postgresql-14                   14.5-0ubuntu0.22.04.1

Ubuntu 20.04 LTS:
  postgresql-12                   12.12-0ubuntu0.20.04.1

Ubuntu 18.04 LTS:
  postgresql-10                   10.22-0ubuntu0.18.04.1

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-5571-1
  CVE-2022-2625

Package Information:
  https://launchpad.net/ubuntu/+source/postgresql-14/14.5-0ubuntu0.22.04.1
  https://launchpad.net/ubuntu/+source/postgresql-12/12.12-0ubuntu0.20.04.1
  https://launchpad.net/ubuntu/+source/postgresql-10/10.22-0ubuntu0.18.04.1

Ubuntu 5571-1: PostgreSQL vulnerability

August 18, 2022

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: PostgreSQL could be made to run programs when creating or updating extensions. Software Description: - postgresql-14: Object-relational SQL database - postgresql-12: Object-relational SQL database - postgresql-10: Object-relational SQL database Details: Sven Klemm discovered that PostgreSQL incorrectly handled extensions. An attacker could possibly use this issue to execute arbitrary code when extensions are created or updated.

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS: postgresql-14 14.5-0ubuntu0.22.04.1 Ubuntu 20.04 LTS: postgresql-12 12.12-0ubuntu0.20.04.1 Ubuntu 18.04 LTS: postgresql-10 10.22-0ubuntu0.18.04.1 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart PostgreSQL to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5571-1

CVE-2022-2625

Severity
Ubuntu Security Notice USN-5571-1

Package Information

https://launchpad.net/ubuntu/+source/postgresql-14/14.5-0ubuntu0.22.04.1 https://launchpad.net/ubuntu/+source/postgresql-12/12.12-0ubuntu0.20.04.1 https://launchpad.net/ubuntu/+source/postgresql-10/10.22-0ubuntu0.18.04.1

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.