Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2023-2454 (GCVE-0-2023-2454)
Vulnerability from cvelistv5 – Published: 2023-06-09 00:00 – Updated: 2025-06-04 03:56
VLAI
EPSS
Summary
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
Severity
7.2 (High)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | postgresql |
Affected:
PostgreSQL 15.3, PostgreSQL 14.8, PostgreSQL 13.11, PostgreSQL 12.15, PostgreSQL 11.20
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:26:08.641Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/CVE-2023-2454"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.postgresql.org/support/security/CVE-2023-2454/"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20230706-0006/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-2454",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-04T03:56:06.743Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "postgresql",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "PostgreSQL 15.3, PostgreSQL 14.8, PostgreSQL 13.11, PostgreSQL 12.15, PostgreSQL 11.20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-06T00:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2023-2454"
},
{
"url": "https://www.postgresql.org/support/security/CVE-2023-2454/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230706-0006/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2023-2454",
"datePublished": "2023-06-09T00:00:00.000Z",
"dateReserved": "2023-05-01T00:00:00.000Z",
"dateUpdated": "2025-06-04T03:56:06.743Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2023-2454",
"date": "2026-05-30",
"epss": "0.00276",
"percentile": "0.51191"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-2454\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2023-06-09T19:15:09.253\",\"lastModified\":\"2025-01-06T18:15:13.670\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.0\",\"versionEndExcluding\":\"11.20\",\"matchCriteriaId\":\"895C54DB-6D0C-4C3C-82E8-32BDB03DD3F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.0\",\"versionEndExcluding\":\"12.15\",\"matchCriteriaId\":\"57895EC0-9A98-4A80-AEDF-86E6423D9D45\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"13.0\",\"versionEndExcluding\":\"13.11\",\"matchCriteriaId\":\"9EA25D57-813D-442D-81C3-82D393CAA41A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.0\",\"versionEndExcluding\":\"14.8\",\"matchCriteriaId\":\"E9171779-EAEA-4D8C-8E05-0B751B9139D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"15.0\",\"versionEndExcluding\":\"15.3\",\"matchCriteriaId\":\"EC91659E-2AE2-486C-8CD3-F41CD189FD6F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"749804DA-4B27-492A-9ABA-6BB562A6B3AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CFF558-3C47-480D-A2F0-BABF26042943\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F6FB57C-2BC7-487C-96DD-132683AEB35D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/security/cve/CVE-2023-2454\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20230706-0006/\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://www.postgresql.org/support/security/CVE-2023-2454/\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/security/cve/CVE-2023-2454\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20230706-0006/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.postgresql.org/support/security/CVE-2023-2454/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2023-2454\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.postgresql.org/support/security/CVE-2023-2454/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20230706-0006/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T06:26:08.641Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-2454\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-06T17:13:48.536214Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-06T17:14:01.720Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"postgresql\", \"versions\": [{\"status\": \"affected\", \"version\": \"PostgreSQL 15.3, PostgreSQL 14.8, PostgreSQL 13.11, PostgreSQL 12.15, PostgreSQL 11.20\"}]}], \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2023-2454\"}, {\"url\": \"https://www.postgresql.org/support/security/CVE-2023-2454/\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20230706-0006/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2023-07-06T00:00:00.000Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-2454\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-04T03:56:06.743Z\", \"dateReserved\": \"2023-05-01T00:00:00.000Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2023-06-09T00:00:00.000Z\", \"assignerShortName\": \"redhat\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
alsa-2023:3714
Vulnerability from osv_almalinux
Published
2023-06-21 00:00
Modified
2023-06-23 15:06
Summary
Moderate: postgresql security update
Details
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
- postgresql: schema_element defeats protective search_path changes (CVE-2023-2454)
- postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.el9_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-contrib"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.el9_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-docs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.el9_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-plperl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.el9_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-plpython3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.el9_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-pltcl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.el9_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-private-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.el9_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-private-libs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.el9_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.el9_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-server-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.el9_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-static"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.el9_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-test"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.el9_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-upgrade"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.el9_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-upgrade-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.el9_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "PostgreSQL is an advanced object-relational database management system (DBMS).\n\nSecurity Fix(es):\n\n* postgresql: schema_element defeats protective search_path changes (CVE-2023-2454)\n* postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "ALSA-2023:3714",
"modified": "2023-06-23T15:06:55Z",
"published": "2023-06-21T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2023:3714"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-2454"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-2455"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2207568"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2207569"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2023-3714.html"
}
],
"related": [
"CVE-2023-2454",
"CVE-2023-2455"
],
"summary": "Moderate: postgresql security update"
}
alsa-2023:4327
Vulnerability from osv_almalinux
Published
2023-07-31 00:00
Modified
2023-08-02 19:09
Summary
Moderate: postgresql:15 security update
Details
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
- postgresql: schema_element defeats protective search_path changes (CVE-2023-2454)
- postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "pg_repack"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.8-1.module_el9.2.0+22+09653793"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "pgaudit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.0-1.module_el9.2.0+22+09653793"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgres-decoderbufs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.7-1.Final.module_el9.2.0+22+09653793"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-contrib"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-docs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-plperl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-plpython3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-pltcl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-private-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-private-libs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-server-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-static"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-test"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-test-rpm-macros"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-upgrade"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "postgresql-upgrade-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el9.2.0+32+f3c125b5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "PostgreSQL is an advanced object-relational database management system (DBMS).\n\nSecurity Fix(es):\n\n* postgresql: schema_element defeats protective search_path changes (CVE-2023-2454)\n* postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "ALSA-2023:4327",
"modified": "2023-08-02T19:09:45Z",
"published": "2023-07-31T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2023:4327"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-2454"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-2455"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2207568"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2207569"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2023-4327.html"
}
],
"related": [
"CVE-2023-2454",
"CVE-2023-2455"
],
"summary": "Moderate: postgresql:15 security update"
}
alsa-2023:4527
Vulnerability from osv_almalinux
Published
2023-08-08 00:00
Modified
2023-08-09 14:42
Summary
Moderate: postgresql:13 security update
Details
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
- postgresql: schema_element defeats protective search_path changes (CVE-2023-2454)
- postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pg_repack"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.6-3.module_el8.6.0+2760+1746ec94"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pg_repack"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.6-3.module_el8.6.0+3095+ee60d910"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pgaudit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0-1.module_el8.6.0+2760+1746ec94"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pgaudit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0-1.module_el8.6.0+3095+ee60d910"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgres-decoderbufs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.0-2.module_el8.6.0+2760+1746ec94"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgres-decoderbufs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.0-2.module_el8.6.0+3095+ee60d910"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.module_el8.8.0+3601+ca64e769"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-contrib"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.module_el8.8.0+3601+ca64e769"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-docs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.module_el8.8.0+3601+ca64e769"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-plperl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.module_el8.8.0+3601+ca64e769"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-plpython3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.module_el8.8.0+3601+ca64e769"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-pltcl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.module_el8.8.0+3601+ca64e769"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.module_el8.8.0+3601+ca64e769"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-server-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.module_el8.8.0+3601+ca64e769"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-static"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.module_el8.8.0+3601+ca64e769"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-test"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.module_el8.8.0+3601+ca64e769"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-test-rpm-macros"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.module_el8.8.0+3601+ca64e769"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-upgrade"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.module_el8.8.0+3601+ca64e769"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-upgrade-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.11-1.module_el8.8.0+3601+ca64e769"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "PostgreSQL is an advanced object-relational database management system (DBMS).\n\nSecurity Fix(es):\n\n* postgresql: schema_element defeats protective search_path changes (CVE-2023-2454)\n* postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "ALSA-2023:4527",
"modified": "2023-08-09T14:42:27Z",
"published": "2023-08-08T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2023:4527"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-2454"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-2455"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2207568"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2207569"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2023-4527.html"
}
],
"related": [
"CVE-2023-2454",
"CVE-2023-2455"
],
"summary": "Moderate: postgresql:13 security update"
}
alsa-2023:4535
Vulnerability from osv_almalinux
Published
2023-08-08 00:00
Modified
2023-08-09 14:24
Summary
Moderate: postgresql:12 security update
Details
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
- postgresql: schema_element defeats protective search_path changes (CVE-2023-2454)
- postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455)
- postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pg_repack"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.6-3.module_el8.6.0+2758+4f4474df"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pg_repack"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.6-3.module_el8.6.0+3094+eb237fb8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pgaudit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.0-5.module_el8.6.0+2758+4f4474df"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pgaudit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.0-5.module_el8.6.0+3094+eb237fb8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgres-decoderbufs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.0-2.module_el8.6.0+3094+eb237fb8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgres-decoderbufs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.0-2.module_el8.6.0+2758+4f4474df"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.15-1.module_el8.8.0+3600+38330172"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-contrib"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.15-1.module_el8.8.0+3600+38330172"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-docs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.15-1.module_el8.8.0+3600+38330172"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-plperl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.15-1.module_el8.8.0+3600+38330172"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-plpython3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.15-1.module_el8.8.0+3600+38330172"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-pltcl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.15-1.module_el8.8.0+3600+38330172"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.15-1.module_el8.8.0+3600+38330172"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-server-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.15-1.module_el8.8.0+3600+38330172"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-static"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.15-1.module_el8.8.0+3600+38330172"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-test"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.15-1.module_el8.8.0+3600+38330172"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-test-rpm-macros"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.15-1.module_el8.8.0+3600+38330172"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-upgrade"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.15-1.module_el8.8.0+3600+38330172"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-upgrade-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "12.15-1.module_el8.8.0+3600+38330172"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "PostgreSQL is an advanced object-relational database management system (DBMS).\n\nSecurity Fix(es):\n\n* postgresql: schema_element defeats protective search_path changes (CVE-2023-2454)\n* postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455)\n* postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "ALSA-2023:4535",
"modified": "2023-08-09T14:24:25Z",
"published": "2023-08-08T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2023:4535"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2022-41862"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-2454"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-2455"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2165722"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2207568"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2207569"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2023-4535.html"
}
],
"related": [
"CVE-2023-2454",
"CVE-2023-2455",
"CVE-2022-41862"
],
"summary": "Moderate: postgresql:12 security update"
}
alsa-2023:4539
Vulnerability from osv_almalinux
Published
2023-08-08 00:00
Modified
2023-08-09 14:09
Summary
Moderate: postgresql:10 security update
Details
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
- postgresql: schema_element defeats protective search_path changes (CVE-2023-2454)
- postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.23-2.module_el8.8.0+3599+77865fc6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-contrib"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.23-2.module_el8.8.0+3599+77865fc6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-docs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.23-2.module_el8.8.0+3599+77865fc6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-plperl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.23-2.module_el8.8.0+3599+77865fc6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-plpython3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.23-2.module_el8.8.0+3599+77865fc6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-pltcl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.23-2.module_el8.8.0+3599+77865fc6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.23-2.module_el8.8.0+3599+77865fc6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-server-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.23-2.module_el8.8.0+3599+77865fc6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-static"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.23-2.module_el8.8.0+3599+77865fc6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-test"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.23-2.module_el8.8.0+3599+77865fc6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-test-rpm-macros"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.23-2.module_el8.8.0+3599+77865fc6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-upgrade"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.23-2.module_el8.8.0+3599+77865fc6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-upgrade-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.23-2.module_el8.8.0+3599+77865fc6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "PostgreSQL is an advanced object-relational database management system (DBMS).\n\nSecurity Fix(es):\n\n* postgresql: schema_element defeats protective search_path changes (CVE-2023-2454)\n* postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "ALSA-2023:4539",
"modified": "2023-08-09T14:09:08Z",
"published": "2023-08-08T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2023:4539"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-2454"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-2455"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2207568"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2207569"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2023-4539.html"
}
],
"related": [
"CVE-2023-2454",
"CVE-2023-2455"
],
"summary": "Moderate: postgresql:10 security update"
}
alsa-2023:5269
Vulnerability from osv_almalinux
Published
2023-09-19 00:00
Modified
2023-09-21 17:17
Summary
Moderate: postgresql:15 security update
Details
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
- postgresql: schema_element defeats protective search_path changes (CVE-2023-2454)
- postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pg_repack"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.8-1.module_el8.8.0+3487+43ec1b9f"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pgaudit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.0-1.module_el8.8.0+3487+43ec1b9f"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgres-decoderbufs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.7-1.Final.module_el8.8.0+3487+43ec1b9f"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-contrib"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-docs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-plperl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-plpython3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-pltcl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-private-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-private-libs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-server-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-static"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-test"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-test-rpm-macros"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-upgrade"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "postgresql-upgrade-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.3-1.module_el8.8.0+3610+f1fe5820"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "PostgreSQL is an advanced object-relational database management system (DBMS).\n\nSecurity Fix(es):\n\n* postgresql: schema_element defeats protective search_path changes (CVE-2023-2454)\n* postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "ALSA-2023:5269",
"modified": "2023-09-21T17:17:02Z",
"published": "2023-09-19T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2023:5269"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-2454"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-2455"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2207568"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2207569"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2023-5269.html"
}
],
"related": [
"CVE-2023-2454",
"CVE-2023-2455"
],
"summary": "Moderate: postgresql:15 security update"
}
Title
Уязвимость системы управления базами данных PostgreSQL, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код
Description
Уязвимость компонента Schema Handler системы управления базами данных PostgreSQL связана с недостатками разграничения доступа. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, повысить свои привилегии и выполнить произвольный код с помощью команды CREATE SCHEMA
Severity
Vendor
Novell Inc., Сообщество свободного программного обеспечения, Canonical Ltd., ООО «Ред Софт», ООО «РусБИТех-Астра», АО «ИВК», Amazon.com Inc., АО «НТЦ ИТ РОСА», PostgreSQL Global Development Group, FreeBSD Project, Postgres Professional, АО "НППКТ", ООО «Газинформсервис»
Software Name
SUSE Linux Enterprise Server for SAP Applications, Suse Linux Enterprise Server, Debian GNU/Linux, Ubuntu, РЕД ОС (запись в едином реестре российских программ №3751), Astra Linux Special Edition (запись в едином реестре российских программ №369), OpenSUSE Leap, Альт 8 СП (запись в едином реестре российских программ №4305), Suse Linux Enterprise Desktop, Amazon Linux 2, РОСА Кобальт (запись в едином реестре российских программ №1999), Amazon Linux, PostgreSQL, FreeBSD, РОСА ХРОМ (запись в едином реестре российских программ №1607), Postgres Pro Certified (запись в едином реестре российских программ №104), АЛЬТ СП 10, ОСОН ОСнова Оnyx (запись в едином реестре российских программ №5913), Jatoba (запись в едином реестре российских программ №5749), ROSA Virtualization 3.0 (запись в едином реестре российских программ №21308)
Software Version
12 SP4 (SUSE Linux Enterprise Server for SAP Applications), 12 SP2-BCL (Suse Linux Enterprise Server), 15 SP1 (SUSE Linux Enterprise Server for SAP Applications), 12 SP5 (Suse Linux Enterprise Server), 12 SP5 (SUSE Linux Enterprise Server for SAP Applications), 10 (Debian GNU/Linux), 20.04 LTS (Ubuntu), 12 SP4-ESPOS (Suse Linux Enterprise Server), 12 SP4-LTSS (Suse Linux Enterprise Server), 15 SP1-LTSS (Suse Linux Enterprise Server), 11 (Debian GNU/Linux), 7.3 (РЕД ОС), 1.7 (Astra Linux Special Edition), 15.4 (OpenSUSE Leap), 15 SP3 (SUSE Linux Enterprise Server for SAP Applications), 15 SP2 (SUSE Linux Enterprise Server for SAP Applications), - (Альт 8 СП), 15 SP4 (Suse Linux Enterprise Desktop), 15 SP4 (SUSE Linux Enterprise Server for SAP Applications), 22.04 LTS (Ubuntu), 15 SP2-LTSS (Suse Linux Enterprise Server), - (Amazon Linux 2), 4.7 (Astra Linux Special Edition), 22.10 (Ubuntu), 15 SP3-LTSS (Suse Linux Enterprise Server), 7.9 (РОСА Кобальт), 18.04 ESM (Ubuntu), 23.04 (Ubuntu), 2023 (Amazon Linux), от 11.0 до 11.20 (PostgreSQL), от 12.0 до 12.15 (PostgreSQL), от 13.0 до 13.11 (PostgreSQL), от 14.0 до 14.8 (PostgreSQL), от 15.0 до 15.3 (PostgreSQL), - (FreeBSD), 12.4 (РОСА ХРОМ), до 11.20.1 (Postgres Pro Certified), до 14.8.2 (Postgres Pro Certified), до 15.3.2 (Postgres Pro Certified), - (АЛЬТ СП 10), до 2.9 (ОСОН ОСнова Оnyx), 4.8 (Jatoba), 1.20 (Jatoba), 3.0 (ROSA Virtualization 3.0)
Possible Mitigations
Использование рекомендаций:
Для PostgreSQL:
https://www.postgresql.org/support/security/CVE-2023-2454/
Для Postgres Pro Certified:
https://postgrespro.ru/products/postgrespro/certified
Для Защищенная система управления базами данных «Jatoba»:
Обновление программного средства до актуальной версии
ДляDebian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2023-2454
Для Ubuntu:
https://ubuntu.com/security/notices/USN-6104-1
Для Amazon Linux:
https://explore.alas.aws.amazon.com/CVE-2023-2454.html
Для FreeBSD:
https://vulners.com/freebsd/FBB5A260-F00F-11ED-BBAE-6CC21735F730
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2023-2454.html
Для ОС АЛЬТ СП 10: установка обновления из публичного репозитория программного средства
Для ОС Astra Linux Special Edition 1.7:
обновить пакет postgresql-11 до 1:11.21-astra.se6+ci1 или более высокой версии, используя рекомендации производителя: https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17
Для ОС Альт 8 СП: установка обновления из публичного репозитория программного средства
Для ОСОН ОСнова Оnyx:
Обновление программного обеспечения postgresql-11 до версии 11.21+repack1-0+deb10u2.osnova0
Для РедОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/
Для операционной системы РОСА ХРОМ:https://abf.rosalinux.ru/advisories/ROSA-SA-2024-2359
Для Astra Linux Special Edition 4.7:
обновить пакет postgresql-11 до 1:11.21-astra.se6+ci1 или более высокой версии, используя рекомендации производителя: https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47
Для ОС РОСА "КОБАЛЬТ": https://abf.rosa.ru/advisories/ROSA-SA-2024-2486
Для ОС РОСА "КОБАЛЬТ": https://abf.rosa.ru/advisories/ROSA-SA-2024-2485
Для ОС РОСА "КОБАЛЬТ": https://abf.rosa.ru/advisories/ROSA-SA-2024-2484
Для ОС РОСА "КОБАЛЬТ": https://abf.rosa.ru/advisories/ROSA-SA-2024-2486
Для ОС РОСА "КОБАЛЬТ": https://abf.rosa.ru/advisories/ROSA-SA-2024-2485
Для ОС РОСА "КОБАЛЬТ": https://abf.rosa.ru/advisories/ROSA-SA-2024-2484
Для программной системы управления средой виртуализации с подсистемой безагентного резервного копирования виртуальных машин «ROSA Virtualization 3.0»: https://abf.rosa.ru/advisories/ROSA-SA-2025-2743
Reference
https://www.postgresql.org/support/security/CVE-2023-2454/
https://security-tracker.debian.org/tracker/CVE-2023-2454
https://ubuntu.com/security/notices/USN-6104-1
https://explore.alas.aws.amazon.com/CVE-2023-2454.html
https://vulners.com/freebsd/FBB5A260-F00F-11ED-BBAE-6CC21735F730
https://www.suse.com/security/cve/CVE-2023-2454.html
https://postgrespro.ru/products/postgrespro/certified
https://altsp.su/obnovleniya-bezopasnosti/
https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17
https://altsp.su/obnovleniya-bezopasnosti/
https://поддержка.нппкт.рф/bin/view/ОСнова/Обновления/2.9/
http://repo.red-soft.ru/redos/7.3c/x86_64/updates/
https://abf.rosalinux.ru/advisories/ROSA-SA-2024-2359
https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47
https://abf.rosa.ru/advisories/ROSA-SA-2024-2486
https://abf.rosa.ru/advisories/ROSA-SA-2024-2485
https://abf.rosa.ru/advisories/ROSA-SA-2024-2484
https://abf.rosa.ru/advisories/ROSA-SA-2024-2486
https://abf.rosa.ru/advisories/ROSA-SA-2024-2485
https://abf.rosa.ru/advisories/ROSA-SA-2024-2484
https://abf.rosa.ru/advisories/ROSA-SA-2025-2743
CWE
CWE-264
{
"CVSS 2.0": "AV:N/AC:L/Au:M/C:C/I:C/A:C",
"CVSS 3.0": "AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Novell Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, Canonical Ltd., \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb, \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb, Amazon.com Inc., \u0410\u041e \u00ab\u041d\u0422\u0426 \u0418\u0422 \u0420\u041e\u0421\u0410\u00bb, PostgreSQL Global Development Group, FreeBSD Project, Postgres Professional, \u0410\u041e \"\u041d\u041f\u041f\u041a\u0422\", \u041e\u041e\u041e \u00ab\u0413\u0430\u0437\u0438\u043d\u0444\u043e\u0440\u043c\u0441\u0435\u0440\u0432\u0438\u0441\u00bb",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "12 SP4 (SUSE Linux Enterprise Server for SAP Applications), 12 SP2-BCL (Suse Linux Enterprise Server), 15 SP1 (SUSE Linux Enterprise Server for SAP Applications), 12 SP5 (Suse Linux Enterprise Server), 12 SP5 (SUSE Linux Enterprise Server for SAP Applications), 10 (Debian GNU/Linux), 20.04 LTS (Ubuntu), 12 SP4-ESPOS (Suse Linux Enterprise Server), 12 SP4-LTSS (Suse Linux Enterprise Server), 15 SP1-LTSS (Suse Linux Enterprise Server), 11 (Debian GNU/Linux), 7.3 (\u0420\u0415\u0414 \u041e\u0421), 1.7 (Astra Linux Special Edition), 15.4 (OpenSUSE Leap), 15 SP3 (SUSE Linux Enterprise Server for SAP Applications), 15 SP2 (SUSE Linux Enterprise Server for SAP Applications), - (\u0410\u043b\u044c\u0442 8 \u0421\u041f), 15 SP4 (Suse Linux Enterprise Desktop), 15 SP4 (SUSE Linux Enterprise Server for SAP Applications), 22.04 LTS (Ubuntu), 15 SP2-LTSS (Suse Linux Enterprise Server), - (Amazon Linux 2), 4.7 (Astra Linux Special Edition), 22.10 (Ubuntu), 15 SP3-LTSS (Suse Linux Enterprise Server), 7.9 (\u0420\u041e\u0421\u0410 \u041a\u043e\u0431\u0430\u043b\u044c\u0442), 18.04 ESM (Ubuntu), 23.04 (Ubuntu), 2023 (Amazon Linux), \u043e\u0442 11.0 \u0434\u043e 11.20 (PostgreSQL), \u043e\u0442 12.0 \u0434\u043e 12.15 (PostgreSQL), \u043e\u0442 13.0 \u0434\u043e 13.11 (PostgreSQL), \u043e\u0442 14.0 \u0434\u043e 14.8 (PostgreSQL), \u043e\u0442 15.0 \u0434\u043e 15.3 (PostgreSQL), - (FreeBSD), 12.4 (\u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c), \u0434\u043e 11.20.1 (Postgres Pro Certified), \u0434\u043e 14.8.2 (Postgres Pro Certified), \u0434\u043e 15.3.2 (Postgres Pro Certified), - (\u0410\u041b\u042c\u0422 \u0421\u041f 10), \u0434\u043e 2.9 (\u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx), 4.8 (Jatoba), 1.20 (Jatoba), 3.0 (ROSA Virtualization 3.0)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f PostgreSQL:\nhttps://www.postgresql.org/support/security/CVE-2023-2454/\n\n\u0414\u043b\u044f Postgres Pro Certified:\nhttps://postgrespro.ru/products/postgrespro/certified\n\n\u0414\u043b\u044f \u0417\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0430\u0437\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u00abJatoba\u00bb:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043e \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438\n\n\u0414\u043b\u044fDebian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2023-2454\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/notices/USN-6104-1\n\n\u0414\u043b\u044f Amazon Linux: \nhttps://explore.alas.aws.amazon.com/CVE-2023-2454.html\n\n\u0414\u043b\u044f FreeBSD:\nhttps://vulners.com/freebsd/FBB5A260-F00F-11ED-BBAE-6CC21735F730\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Novell Inc.:\nhttps://www.suse.com/security/cve/CVE-2023-2454.html\n\n\u0414\u043b\u044f \u041e\u0421 \u0410\u041b\u042c\u0422 \u0421\u041f 10: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\n\n\u0414\u043b\u044f \u041e\u0421 Astra Linux Special Edition 1.7:\n\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 postgresql-11 \u0434\u043e 1:11.21-astra.se6+ci1 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17\n\n\u0414\u043b\u044f \u041e\u0421 \u0410\u043b\u044c\u0442 8 \u0421\u041f: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\n\n\u0414\u043b\u044f \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f postgresql-11 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 11.21+repack1-0+deb10u2.osnova0\n\n\u0414\u043b\u044f \u0420\u0435\u0434\u041e\u0421: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/\n\n\u0414\u043b\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c:https://abf.rosalinux.ru/advisories/ROSA-SA-2024-2359\n\n\u0414\u043b\u044f Astra Linux Special Edition 4.7:\n\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 postgresql-11 \u0434\u043e 1:11.21-astra.se6+ci1 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47\n\n\u0414\u043b\u044f \u041e\u0421 \u0420\u041e\u0421\u0410 \"\u041a\u041e\u0411\u0410\u041b\u042c\u0422\": https://abf.rosa.ru/advisories/ROSA-SA-2024-2486\n\n\u0414\u043b\u044f \u041e\u0421 \u0420\u041e\u0421\u0410 \"\u041a\u041e\u0411\u0410\u041b\u042c\u0422\": https://abf.rosa.ru/advisories/ROSA-SA-2024-2485\n\n\u0414\u043b\u044f \u041e\u0421 \u0420\u041e\u0421\u0410 \"\u041a\u041e\u0411\u0410\u041b\u042c\u0422\": https://abf.rosa.ru/advisories/ROSA-SA-2024-2484\n\n\u0414\u043b\u044f \u041e\u0421 \u0420\u041e\u0421\u0410 \"\u041a\u041e\u0411\u0410\u041b\u042c\u0422\": https://abf.rosa.ru/advisories/ROSA-SA-2024-2486\n\n\u0414\u043b\u044f \u041e\u0421 \u0420\u041e\u0421\u0410 \"\u041a\u041e\u0411\u0410\u041b\u042c\u0422\": https://abf.rosa.ru/advisories/ROSA-SA-2024-2485\n\n\u0414\u043b\u044f \u041e\u0421 \u0420\u041e\u0421\u0410 \"\u041a\u041e\u0411\u0410\u041b\u042c\u0422\": https://abf.rosa.ru/advisories/ROSA-SA-2024-2484\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u043e\u0439 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u0431\u0435\u0437\u0430\u0433\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u00abROSA Virtualization 3.0\u00bb: https://abf.rosa.ru/advisories/ROSA-SA-2025-2743",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "11.05.2023",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "19.03.2025",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "20.06.2023",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2023-03247",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2023-2454",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "SUSE Linux Enterprise Server for SAP Applications, Suse Linux Enterprise Server, Debian GNU/Linux, Ubuntu, \u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Astra Linux Special Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), OpenSUSE Leap, \u0410\u043b\u044c\u0442 8 \u0421\u041f (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21164305), Suse Linux Enterprise Desktop, Amazon Linux 2, \u0420\u041e\u0421\u0410 \u041a\u043e\u0431\u0430\u043b\u044c\u0442 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21161999), Amazon Linux, PostgreSQL, FreeBSD, \u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21161607), Postgres Pro Certified (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116104), \u0410\u041b\u042c\u0422 \u0421\u041f 10, \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21165913), Jatoba (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21165749), ROSA Virtualization 3.0 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u211621308)",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP4 , Novell Inc. Suse Linux Enterprise Server 12 SP2-BCL , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP1 , Novell Inc. Suse Linux Enterprise Server 12 SP5 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP5 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 10 , Canonical Ltd. Ubuntu 20.04 LTS , Novell Inc. Suse Linux Enterprise Server 12 SP4-ESPOS , Novell Inc. Suse Linux Enterprise Server 12 SP4-LTSS , Novell Inc. Suse Linux Enterprise Server 15 SP1-LTSS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 1.7 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), Novell Inc. OpenSUSE Leap 15.4 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP3 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP2 , \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb \u0410\u043b\u044c\u0442 8 \u0421\u041f - (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21164305), Novell Inc. Suse Linux Enterprise Desktop 15 SP4 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP4 , Canonical Ltd. Ubuntu 22.04 LTS , Novell Inc. Suse Linux Enterprise Server 15 SP2-LTSS , Amazon.com Inc. Amazon Linux 2 - , \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 4.7 ARM (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), Canonical Ltd. Ubuntu 22.10 , Novell Inc. Suse Linux Enterprise Server 15 SP3-LTSS , \u0410\u041e \u00ab\u041d\u0422\u0426 \u0418\u0422 \u0420\u041e\u0421\u0410\u00bb \u0420\u041e\u0421\u0410 \u041a\u043e\u0431\u0430\u043b\u044c\u0442 7.9 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21161999), Canonical Ltd. Ubuntu 18.04 ESM , Canonical Ltd. Ubuntu 23.04 , Amazon.com Inc. Amazon Linux 2023 , FreeBSD Project FreeBSD - , \u0410\u041e \u00ab\u041d\u0422\u0426 \u0418\u0422 \u0420\u041e\u0421\u0410\u00bb \u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c 12.4 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21161607), \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb \u0410\u041b\u042c\u0422 \u0421\u041f 10 - , \u0410\u041e \"\u041d\u041f\u041f\u041a\u0422\" \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx \u0434\u043e 2.9 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21165913), \u0410\u041e \u00ab\u041d\u0422\u0426 \u0418\u0422 \u0420\u041e\u0421\u0410\u00bb ROSA Virtualization 3.0 3.0 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u211621308)",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0430\u0437\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 PostgreSQL, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u0440\u0430\u0437\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0420\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f, \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c (CWE-264)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 Schema Handler \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0430\u0437\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 PostgreSQL \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u0440\u0430\u0437\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u044b CREATE SCHEMA",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "\u0412 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 CREATE SCHEMA \u043e\u0431\u044a\u0435\u043a\u0442\u044b \u0432 \u0442\u0435\u043a\u0443\u0449\u0435\u043c search_path, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u044b \u0432 \u043d\u043e\u0432\u043e\u0439 \u0441\u0445\u0435\u043c\u0435 \u0431\u044b\u043b\u0438 \u0432\u0438\u0434\u043d\u044b \u0434\u0430\u0436\u0435 \u0432\u043d\u0443\u0442\u0440\u0438 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0438\u043b\u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430, \u043f\u044b\u0442\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u0437\u0430\u0434\u0430\u0442\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 search_path.",
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.postgresql.org/support/security/CVE-2023-2454/\nhttps://security-tracker.debian.org/tracker/CVE-2023-2454\nhttps://ubuntu.com/security/notices/USN-6104-1\nhttps://explore.alas.aws.amazon.com/CVE-2023-2454.html\nhttps://vulners.com/freebsd/FBB5A260-F00F-11ED-BBAE-6CC21735F730\nhttps://www.suse.com/security/cve/CVE-2023-2454.html\nhttps://postgrespro.ru/products/postgrespro/certified\nhttps://altsp.su/obnovleniya-bezopasnosti/\nhttps://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17\nhttps://altsp.su/obnovleniya-bezopasnosti/\nhttps://\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430.\u043d\u043f\u043f\u043a\u0442.\u0440\u0444/bin/view/\u041e\u0421\u043d\u043e\u0432\u0430/\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f/2.9/\nhttp://repo.red-soft.ru/redos/7.3c/x86_64/updates/\nhttps://abf.rosalinux.ru/advisories/ROSA-SA-2024-2359\nhttps://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47\nhttps://abf.rosa.ru/advisories/ROSA-SA-2024-2486\nhttps://abf.rosa.ru/advisories/ROSA-SA-2024-2485\nhttps://abf.rosa.ru/advisories/ROSA-SA-2024-2484\nhttps://abf.rosa.ru/advisories/ROSA-SA-2024-2486\nhttps://abf.rosa.ru/advisories/ROSA-SA-2024-2485\nhttps://abf.rosa.ru/advisories/ROSA-SA-2024-2484\nhttps://abf.rosa.ru/advisories/ROSA-SA-2025-2743",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u0421\u0423\u0411\u0414, \u041f\u041e \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0418\u0418, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-264",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,3)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,2)"
}
bit-postgresql-2023-2454
Vulnerability from bitnami_vulndb
Published
2024-03-06 11:03
Modified
2025-04-03 14:40
Summary
Details
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
{
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "postgresql",
"purl": "pkg:bitnami/postgresql"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.20.0"
},
{
"introduced": "12.0.0"
},
{
"fixed": "12.15.0"
},
{
"introduced": "13.0.0"
},
{
"fixed": "13.11.0"
},
{
"introduced": "14.0.0"
},
{
"fixed": "14.8.0"
},
{
"introduced": "15.0.0"
},
{
"fixed": "15.3.0"
}
],
"type": "SEMVER"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
],
"aliases": [
"CVE-2023-2454"
],
"database_specific": {
"cpes": [
"cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*"
],
"severity": "High"
},
"details": "schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.",
"id": "BIT-postgresql-2023-2454",
"modified": "2025-04-03T14:40:37.652Z",
"published": "2024-03-06T11:03:35.986Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-2454"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230706-0006/"
},
{
"type": "WEB",
"url": "https://www.postgresql.org/support/security/CVE-2023-2454/"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2454"
}
],
"schema_version": "1.5.0"
}
CERTFR-2023-AVI-0378
Vulnerability from certfr_avis - Published: 2023-05-12 - Updated: 2023-05-12
De multiples vulnérabilités ont été découvertes dans PostgreSQL. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| PostgreSQL | PostgreSQL | PostgreSQL versions 13.x antérieures à 13.11 | ||
| PostgreSQL | PostgreSQL | PostgreSQL versions 14.x antérieures à 14.8 | ||
| PostgreSQL | PostgreSQL | PostgreSQL versions 12.x antérieures à 12.15 | ||
| PostgreSQL | PostgreSQL | PostgreSQL versions antérieures à 11.20 | ||
| PostgreSQL | PostgreSQL | PostgreSQL versions 15.x antérieures à 15.3 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "PostgreSQL versions 13.x ant\u00e9rieures \u00e0 13.11",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "PostgreSQL versions 14.x ant\u00e9rieures \u00e0 14.8",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "PostgreSQL versions 12.x ant\u00e9rieures \u00e0 12.15",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "PostgreSQL versions ant\u00e9rieures \u00e0 11.20",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "PostgreSQL versions 15.x ant\u00e9rieures \u00e0 15.3",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-2454",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2454"
},
{
"name": "CVE-2023-2455",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2455"
}
],
"initial_release_date": "2023-05-12T00:00:00",
"last_revision_date": "2023-05-12T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0378",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-05-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans PostgreSQL. Elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans PostgreSQL",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 PostgreSQL released-2637 du 11 mai 2023",
"url": "https://www.postgresql.org/about/news/postgresql-153-148-1311-1215-and-1120-released-2637/"
}
]
}
CERTFR-2023-AVI-0627
Vulnerability from certfr_avis - Published: 2023-08-04 - Updated: 2023-08-04
De multiples vulnérabilités ont été découvertes dans IBM Spectrum. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Spectrum Sentinel Anomaly Scan Engine versions 1.1.x ant\u00e9rieures \u00e0 1.1.4.1 sur Linux",
"product": {
"name": "Spectrum",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Spectrum Copy Data Management versions 2.2.x ant\u00e9rieures \u00e0 2.2.20.1 sur Linux",
"product": {
"name": "Spectrum",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-25577",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25577"
},
{
"name": "CVE-2022-35252",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35252"
},
{
"name": "CVE-2023-28466",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28466"
},
{
"name": "CVE-2023-0461",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0461"
},
{
"name": "CVE-2022-3628",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3628"
},
{
"name": "CVE-2022-42703",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42703"
},
{
"name": "CVE-2023-23934",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23934"
},
{
"name": "CVE-2022-3567",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3567"
},
{
"name": "CVE-2022-4129",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4129"
},
{
"name": "CVE-2022-43552",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43552"
},
{
"name": "CVE-2021-33655",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33655"
},
{
"name": "CVE-2022-1462",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1462"
},
{
"name": "CVE-2022-2663",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2663"
},
{
"name": "CVE-2022-3524",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3524"
},
{
"name": "CVE-2022-3625",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3625"
},
{
"name": "CVE-2022-42721",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42721"
},
{
"name": "CVE-2023-1195",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1195"
},
{
"name": "CVE-2023-2454",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2454"
},
{
"name": "CVE-2023-0394",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0394"
},
{
"name": "CVE-2022-43551",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43551"
},
{
"name": "CVE-2023-29400",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29400"
},
{
"name": "CVE-2022-3623",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3623"
},
{
"name": "CVE-2023-2455",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2455"
},
{
"name": "CVE-2023-24329",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24329"
},
{
"name": "CVE-2023-32233",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32233"
},
{
"name": "CVE-2022-3028",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3028"
},
{
"name": "CVE-2022-3566",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3566"
}
],
"initial_release_date": "2023-08-04T00:00:00",
"last_revision_date": "2023-08-04T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0627",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-08-04T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans IBM Spectrum.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Spectrum",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7011323 du 28 juillet 2023",
"url": "https://www.ibm.com/support/pages/node/7011323"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7014493 du 28 juillet 2023",
"url": "https://www.ibm.com/support/pages/node/7014493"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7012459 du 28 juillet 2023",
"url": "https://www.ibm.com/support/pages/node/7012459"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…