Security
Headlines
HeadlinesLatestCVEs

Headline

Ubuntu Security Notice USN-6968-3

Ubuntu Security Notice 6968-3 - USN-6968-1 fixedCVE-2024-7348 in PostgreSQL-12, PostgreSQL-14, and PostgreSQL-16. This update provides the corresponding updates for PostgreSQL-9.3 in Ubuntu 14.04 LTS and PostgreSQL-10 in Ubuntu 18.04 LTS. Noah Misch discovered that PostgreSQL incorrectly handled certain SQL objects. An attacker could possibly use this issue to execute arbitrary SQL functions as the superuser.

Packet Storm
#sql#vulnerability#ubuntu#postgres

==========================================================================
Ubuntu Security Notice USN-6968-3
October 14, 2024

postgresql-10, postgresql-9.3 vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 18.04 LTS
  • Ubuntu 14.04 LTS

Summary:

PostgreSQL could execute arbitrary SQL functions as the superuser
if it received a specially crafted SQL object.

Software Description:

  • postgresql-10: Object-relational SQL database
  • postgresql-9.3: Object-relational SQL database

Details:

USN-6968-1 fixed CVE-2024-7348 in PostgreSQL-12, PostgreSQL-14, and
PostgreSQL-16.

This update provides the corresponding updates for PostgreSQL-9.3 in
Ubuntu 14.04 LTS and PostgreSQL-10 in Ubuntu 18.04 LTS.

Original advisory details:

Noah Misch discovered that PostgreSQL incorrectly handled certain
SQL objects. An attacker could possibly use this issue to execute
arbitrary SQL functions as the superuser.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS
postgresql-10 10.23-0ubuntu0.18.04.2+esm2
Available with Ubuntu Pro
postgresql-client-10 10.23-0ubuntu0.18.04.2+esm2
Available with Ubuntu Pro

Ubuntu 14.04 LTS
postgresql-9.3 9.3.24-0ubuntu0.14.04+esm1
Available with Ubuntu Pro
postgresql-client-9.3 9.3.24-0ubuntu0.14.04+esm1
Available with Ubuntu Pro

After a standard system update you need to restart PostgreSQL to
make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6968-3
https://ubuntu.com/security/notices/USN-6968-2
https://ubuntu.com/security/notices/USN-6968-1
CVE-2024-7348

Related news

Red Hat Security Advisory 2024-6559-03

Red Hat Security Advisory 2024-6559-03 - An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.

Red Hat Security Advisory 2024-6558-03

Red Hat Security Advisory 2024-6558-03 - An update for the postgresql:13 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.

Red Hat Security Advisory 2024-6557-03

Red Hat Security Advisory 2024-6557-03 - An update for the postgresql:13 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service.

Red Hat Security Advisory 2024-6020-03

Red Hat Security Advisory 2024-6020-03 - An update for the postgresql:15 module is now available for Red Hat Enterprise Linux 9.

Red Hat Security Advisory 2024-6001-03

Red Hat Security Advisory 2024-6001-03 - An update for the postgresql:15 module is now available for Red Hat Enterprise Linux 8.

Red Hat Security Advisory 2024-6000-03

Red Hat Security Advisory 2024-6000-03 - An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 8.10.

Red Hat Security Advisory 2024-5999-03

Red Hat Security Advisory 2024-5999-03 - An update for the postgresql is now available for Red Hat Enterprise Linux 9.

Ubuntu Security Notice USN-6968-1

Ubuntu Security Notice 6968-1 - Noah Misch discovered that PostgreSQL incorrectly handled certain SQL objects. An attacker could possibly use this issue to execute arbitrary SQL functions as the superuser.

Debian Security Advisory 5746-1

Debian Linux Security Advisory 5746-1 - Noah Misch discovered a race condition in the pg_dump tool included in PostgreSQL, which may result in privilege escalation.

Debian Security Advisory 5745-1

Debian Linux Security Advisory 5745-1 - Noah Misch discovered a race condition in the pg_dump tool included in PostgreSQL, which may result in privilege escalation.

Packet Storm: Latest News

Ivanti EPM Agent Portal Command Execution