[SECURITY] [DLA 3422-1] postgresql-11 security update

2023-05-1509:06:31

lists.debian.org

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

Low

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:M/C:P/I:P/A:P

0.0005 Low

EPSS

Percentile

17.2%

JSON

Debian LTS Advisory DLA-3422-1 [email protected]
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
May 15, 2023 https://wiki.debian.org/LTS

Package : postgresql-11
Version : 11.20-0+deb10u1
CVE ID : CVE-2023-2454 CVE-2023-2455

Two security issues were found in PostgreSQL, which may result in
privilege escalation or incorrect policy enforcement.

For Debian 10 buster, these problems have been fixed in version
11.20-0+deb10u1.

We recommend that you upgrade your postgresql-11 packages.

For the detailed security status of postgresql-11 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/postgresql-11

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10alllibecpg-dev< 11.20-0+deb10u1libecpg-dev_11.20-0+deb10u1_all.deb
Debian10alllibpq5< 11.20-0+deb10u1libpq5_11.20-0+deb10u1_all.deb
Debian10alllibecpg6< 11.20-0+deb10u1libecpg6_11.20-0+deb10u1_all.deb
Debian10alllibpq-dev< 11.20-0+deb10u1libpq-dev_11.20-0+deb10u1_all.deb
Debian10alllibpgtypes3< 11.20-0+deb10u1libpgtypes3_11.20-0+deb10u1_all.deb
Debian10alllibecpg-compat3< 11.20-0+deb10u1libecpg-compat3_11.20-0+deb10u1_all.deb
Debian10allpostgresql-plpython3-11< 11.20-0+deb10u1postgresql-plpython3-11_11.20-0+deb10u1_all.deb
Debian10allpostgresql-11< 11.20-0+deb10u1postgresql-11_11.20-0+deb10u1_all.deb
Debian10allpostgresql-client-11< 11.20-0+deb10u1postgresql-client-11_11.20-0+deb10u1_all.deb
Debian10allpostgresql-doc-11< 11.20-0+deb10u1postgresql-doc-11_11.20-0+deb10u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	libecpg-dev	< 11.20-0+deb10u1	libecpg-dev_11.20-0+deb10u1_all.deb
Debian	10	all	libpq5	< 11.20-0+deb10u1	libpq5_11.20-0+deb10u1_all.deb
Debian	10	all	libecpg6	< 11.20-0+deb10u1	libecpg6_11.20-0+deb10u1_all.deb
Debian	10	all	libpq-dev	< 11.20-0+deb10u1	libpq-dev_11.20-0+deb10u1_all.deb
Debian	10	all	libpgtypes3	< 11.20-0+deb10u1	libpgtypes3_11.20-0+deb10u1_all.deb
Debian	10	all	libecpg-compat3	< 11.20-0+deb10u1	libecpg-compat3_11.20-0+deb10u1_all.deb
Debian	10	all	postgresql-plpython3-11	< 11.20-0+deb10u1	postgresql-plpython3-11_11.20-0+deb10u1_all.deb
Debian	10	all	postgresql-11	< 11.20-0+deb10u1	postgresql-11_11.20-0+deb10u1_all.deb
Debian	10	all	postgresql-client-11	< 11.20-0+deb10u1	postgresql-client-11_11.20-0+deb10u1_all.deb
Debian	10	all	postgresql-doc-11	< 11.20-0+deb10u1	postgresql-doc-11_11.20-0+deb10u1_all.deb