Lucene search

K
osvGoogleOSV:USN-6538-2
HistoryJan 17, 2024 - 5:20 a.m.

postgresql-10 vulnerabilities

2024-01-1705:20:49
Google
osv.dev
5
postgresql
vulnerabilities
ubuntu 18.04 lts
remote attacker
sensitive information
arbitrary code
cve-2023-5868
cve-2023-5869
cve-2023-5870

9.6 High

AI Score

Confidence

High

0.015 Low

EPSS

Percentile

86.6%

USN-6538-1 fixed several vulnerabilities in PostgreSQL. This update provides
the corresponding updates for Ubuntu 18.04 LTS.

Original advisory details:

Jingzhou Fu discovered that PostgreSQL incorrectly handled certain unknown
arguments in aggregate function calls. A remote attacker could possibly use
this issue to obtain sensitive information. (CVE-2023-5868)

Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)

Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signal certain superuser processes,
contrary to expectations. (CVE-2023-5870)