Ubuntu 22.04 LTS USN-6104-1 Critical PostgreSQL Access Issues

ubuntu

May 24, 2023

Several security issues were fixed in PostgreSQL.

Summary

Several security issues were fixed in PostgreSQL.

Software Description:

- postgresql-15: Object-relational SQL database

- postgresql-14: Object-relational SQL database

- postgresql-12: Object-relational SQL database

- postgresql-10: Object-relational SQL database

Details:

Alexander Lakhin discovered that PostgreSQL incorrectly handled certain

CREATE privileges. An authenticated user could possibly use this issue to

execute arbitrary code as the bootstrap supervisor. (CVE-2023-2454)

Wolfgang Walther discovered that PostgreSQL incorrectly handled certain row

security policies. An authenticated user could possibly use this issue to

complete otherwise forbidden reads and modifications. (CVE-2023-2455)

Topics Covered

security advisory security issue critical software update access control ubuntu postgresql

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
   postgresql-15                   15.3-0ubuntu0.23.04.1
   postgresql-client-15            15.3-0ubuntu0.23.04.1

Ubuntu 22.10:
   postgresql-14                   14.8-0ubuntu0.22.10.1
   postgresql-client-14            14.8-0ubuntu0.22.10.1

Ubuntu 22.04 LTS:
   postgresql-14                   14.8-0ubuntu0.22.04.1
   postgresql-client-14            14.8-0ubuntu0.22.04.1

Ubuntu 20.04 LTS:
   postgresql-12                   12.15-0ubuntu0.20.04.1
   postgresql-client-12            12.15-0ubuntu0.20.04.1

Ubuntu 18.04 LTS:
   postgresql-10                   10.23-0ubuntu0.18.04.2
   postgresql-client-10            10.23-0ubuntu0.18.04.2

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.