Lucene search

K
cloudfoundryCloud FoundryCFOUNDRY:7FAB63BA6A7A3E716B62D1065B647252
HistoryMar 18, 2024 - 12:00 a.m.

USN-6296-1: PostgreSQL vulnerabilities | Cloud Foundry

2024-03-1800:00:00
Cloud Foundry
www.cloudfoundry.org
5
postgresql
ubuntu
cloud foundry
vulnerabilities
extension script
remote attacker
update instructions
cflinuxfs4
cf deployment
mitigation
usn notice

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

50.6%

Severity

Unknown

Vendor

Canonical Ubuntu

Versions Affected

  • Canonical Ubuntu 22.04

Description

It was discovered that PostgreSQL incorrectly handled certain extension script substitutions. An attacker having database-level CREATE privileges can use this issue to execute arbitrary code as the bootstrap superuser. (CVE-2023-39417) It was discovered that PostgreSQL incorrectly handled the MERGE command. A remote attacker could possibly use this issue to bypass certain UPDATE and SELECT policies. This issue only affected Ubuntu 23.04. (CVE-2023-39418) Update Instructions: Run sudo pro fix USN-6296-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: postgresql-server-dev-12 – 12.16-0ubuntu0.20.04.1 libecpg6 – 12.16-0ubuntu0.20.04.1 libpq-dev – 12.16-0ubuntu0.20.04.1 libpgtypes3 – 12.16-0ubuntu0.20.04.1 postgresql-plperl-12 – 12.16-0ubuntu0.20.04.1 postgresql-pltcl-12 – 12.16-0ubuntu0.20.04.1 libecpg-dev – 12.16-0ubuntu0.20.04.1 postgresql-plpython3-12 – 12.16-0ubuntu0.20.04.1 libpq5 – 12.16-0ubuntu0.20.04.1 postgresql-doc-12 – 12.16-0ubuntu0.20.04.1 postgresql-12 – 12.16-0ubuntu0.20.04.1 postgresql-client-12 – 12.16-0ubuntu0.20.04.1 libecpg-compat3 – 12.16-0ubuntu0.20.04.1 No subscription required

Affected Cloud Foundry Products and Versions

Severity is unknown unless otherwise noted.

  • cflinuxfs4
    • All versions prior to 1.31.0
  • CF Deployment
    • All versions prior to 32.2.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below.

The Cloud Foundry project recommends upgrading the following releases:

  • cflinuxfs4
    • Upgrade all versions to 1.31.0 or greater
  • CF Deployment
    • Upgrade all versions to 32.2.0 or greater

References

History

2024-03-18: Initial vulnerability report published.

Affected configurations

Vulners
Node
cloud_foundrydiegoRange<1.31.0
OR
cloud_foundrycf-networkingRange<32.2.0
CPENameOperatorVersion
cflinuxfs4lt1.31.0
cf deploymentlt32.2.0

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

50.6%