USN-6538-1: PostgreSQL vulnerabilities

Releases

• Ubuntu 23.10
• Ubuntu 23.04
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• postgresql-12 - Object-relational SQL database
• postgresql-14 - Object-relational SQL database
• postgresql-15 - Object-relational SQL database

Details

Jingzhou Fu discovered that PostgreSQL incorrectly handled certain unknown
arguments in aggregate function calls. A remote attacker could possibly use
this issue to obtain sensitive information. (CVE-2023-5868)

Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)

Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signal certain superuser processes,
contrary to expectations. (CVE-2023-5870)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.10

• postgresql-15 - 15.5-0ubuntu0.23.10.1
• postgresql-client-15 - 15.5-0ubuntu0.23.10.1

Ubuntu 23.04

• postgresql-15 - 15.5-0ubuntu0.23.04.1
• postgresql-client-15 - 15.5-0ubuntu0.23.04.1

Ubuntu 22.04

• postgresql-14 - 14.10-0ubuntu0.22.04.1
• postgresql-client-14 - 14.10-0ubuntu0.22.04.1

Ubuntu 20.04

• postgresql-12 - 12.17-0ubuntu0.20.04.1
• postgresql-client-12 - 12.17-0ubuntu0.20.04.1

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.

References

• CVE-2023-5869
• CVE-2023-5870
• CVE-2023-5868

Related notices

• USN-6570-1
• USN-6538-2