Lucene search
UbuntuUSN-6296-1HistoryAug 17, 2023 - 12:00 a.m.
PostgreSQL vulnerabilities
2023-08-1700:00:00
ubuntu.com
30
postgresql
ubuntu
vulnerabilities
cve-2023-39417
cve-2023-39418
packages
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.5 High
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
50.6%
Releases
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Packages
- postgresql-12 - Object-relational SQL database
- postgresql-14 - Object-relational SQL database
- postgresql-15 - Object-relational SQL database
Details
It was discovered that PostgreSQL incorrectly handled certain extension
script substitutions. An attacker having database-level CREATE privileges
can use this issue to execute arbitrary code as the bootstrap superuser.
(CVE-2023-39417)
It was discovered that PostgreSQL incorrectly handled the MERGE command. A
remote attacker could possibly use this issue to bypass certain UPDATE and
SELECT policies. This issue only affected Ubuntu 23.04. (CVE-2023-39418)
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 23.04 | noarch | postgresql-15 | < 15.4-0ubuntu0.23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libecpg-compat3 | < 15.4-0ubuntu0.23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libecpg-compat3-dbgsym | < 15.4-0ubuntu0.23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libecpg-dev | < 15.4-0ubuntu0.23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libecpg-dev-dbgsym | < 15.4-0ubuntu0.23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libecpg6 | < 15.4-0ubuntu0.23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libecpg6-dbgsym | < 15.4-0ubuntu0.23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libpgtypes3 | < 15.4-0ubuntu0.23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libpgtypes3-dbgsym | < 15.4-0ubuntu0.23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libpq-dev | < 15.4-0ubuntu0.23.04.1 | UNKNOWN |
Related
mageia
mageia
Updated postgresql packages fix security vulnerability
2023-09-11 16:07:54
openvas
openvas
openSUSE: Security Advisory for postgresql15 (SUSE-SU-2023:3347-1)
2024-03-04 00:00:00
SUSE: Security Advisory (SUSE-SU-2023:3342-1)
2023-08-18 00:00:00
Ubuntu: Security Advisory (USN-6296-1)
2023-08-18 00:00:00
nessus
nessus
osv
osv
postgresql-12, postgresql-14, postgresql-15 vulnerabilities
2023-08-17 11:56:22
CVE-2023-39418
2023-08-11 13:15:09
Important: postgresql:15 security update
2023-12-20 00:00:00
cloudfoundry
cloudfoundry
USN-6296-1: PostgreSQL vulnerabilities | Cloud Foundry
2024-03-18 00:00:00
cvelist
cvelist
ubuntucve
ubuntucve
CVE-2023-39418
2023-08-11 00:00:00
CVE-2023-39417
2023-08-11 00:00:00
prion
prion
Command injection
2023-08-11 13:15:00
Sql injection
2023-08-11 13:15:00
ibm
ibm
redhatcve
redhatcve
CVE-2023-39418
2023-08-11 06:19:28
CVE-2023-39417
2023-08-11 06:19:18
oraclelinux
oraclelinux
postgresql:15 security update
2023-12-13 00:00:00
postgresql:15 security update
2023-12-20 00:00:00
postgresql:13 security update
2023-11-30 00:00:00
redhat
redhat
(RHSA-2023:7883) Important: postgresql:15 security update
2023-12-20 09:19:16
(RHSA-2023:7785) Important: postgresql:15 security update
2023-12-13 14:48:30
(RHSA-2023:7885) Important: postgresql:15 security update
2023-12-20 09:19:18
almalinux
almalinux
Important: postgresql:15 security update
2023-12-20 00:00:00
Important: postgresql:15 security update
2023-12-13 00:00:00
Important: postgresql:12 security update
2023-12-11 00:00:00
debiancve
debiancve
CVE-2023-39418
2023-08-11 13:15:09
CVE-2023-39417
2023-08-11 13:15:09
alpinelinux
alpinelinux
CVE-2023-39418
2023-08-11 13:15:09
CVE-2023-39417
2023-08-11 13:15:09
nvd
nvd
CVE-2023-39418
2023-08-11 13:15:09
CVE-2023-39417
2023-08-11 13:15:09
kaspersky
kaspersky
KLA52239 RCE vulnerability in PostgreSQL
2023-08-10 00:00:00
KLA52240 RCE vulnerability in PostgreSQL
2023-08-10 00:00:00
cve
cve
CVE-2023-39418
2023-08-11 13:15:09
CVE-2023-39417
2023-08-11 13:15:09
freebsd
freebsd
veracode
veracode
Denial Of Service (DoS)
2023-08-16 00:26:29
SQL Injection
2023-08-16 00:26:16
debian
debian
[SECURITY] [DSA 5553-1] postgresql-15 security update
2023-11-13 21:15:25
[SECURITY] [DLA 3600-1] postgresql-11 security update
2023-10-03 21:57:11
[SECURITY] [DSA 5554-1] postgresql-13 security update
2023-11-13 21:27:39
rocky
rocky
postgresql:15 security update
2024-01-09 04:08:12
postgresql:12 security update
2024-01-09 04:07:10
postgresql:13 security update
2023-12-06 23:16:33
ubuntu
ubuntu
PostgreSQL vulnerability
2023-09-13 00:00:00
redos
redos
ROS-20231009-01
2023-10-09 00:00:00
ROS-20240329-14
2024-03-29 00:00:00
ROS-20240329-12
2024-03-29 00:00:00
broadcom
broadcom
cbl_mariner
cbl_mariner
CVE-2023-39417 affecting package postgresql for versions less than 14.10-1
2024-01-14 22:46:30
rosalinux
rosalinux
Advisory ROSA-SA-2024-2359
2024-02-27 09:01:10
photon
photon
Important Photon OS Security Update - PHSA-2023-3.0-0632
2023-08-14 00:00:00
Important Photon OS Security Update - PHSA-2023-4.0-0450
2023-08-14 00:00:00
hp
hp
HP Device Manager Vulnerability Update (5.0.12)
2024-01-26 00:00:00
ics
ics
Siemens SINEC NMS
2024-02-15 12:00:00
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.5 High
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
50.6%
Related for USN-6296-1