Ubuntu 24.04 LTS USN-6802-1 Moderate: PostgreSQL Sensitive Info Leak

ubuntu

May 30, 2024

PostgreSQL could be made to expose sensitive information.

Summary

PostgreSQL could be made to expose sensitive information.

Software Description:

- postgresql-16: Object-relational SQL database

- postgresql-15: Object-relational SQL database

- postgresql-14: Object-relational SQL database

Details:

Lukas Fittl discovered that PostgreSQL incorrectly performed authorization

in the built-in pg_stats_ext and pg_stats_ext_exprs views. An unprivileged

database user can use this issue to read most common values and other

statistics from CREATE STATISTICS commands of other users.

NOTE: This update will only fix fresh PostgreSQL installations. Current

PostgreSQL installations will remain vulnerable to this issue until manual

steps are performed. Please see the instructions in the changelog located

at /usr/share/doc/postgresql-*/changelog.Debian.gz after the updated

packages have been installed, or in the PostgreSQL release notes located

here:

https://www.postgresql.org/docs/16/release-16-3.html

https://www.postgresql.org/docs/15...

Read the Full Advisory

Topics Covered

security advisory moderate ubuntu sensitive information postgresql

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   postgresql-16                   16.3-0ubuntu0.24.04.1
   postgresql-client-16            16.3-0ubuntu0.24.04.1

Ubuntu 23.10
   postgresql-15                   15.7-0ubuntu0.23.10.1
   postgresql-client-15            15.7-0ubuntu0.23.10.1

Ubuntu 22.04 LTS
   postgresql-14                   14.12-0ubuntu0.22.04.1
   postgresql-client-14            14.12-0ubuntu0.22.04.1

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes, and possibly perform manual steps as
described above.