- Vulnerability/
- USN-6296-1
USN-6296-1: PostgreSQL vulnerabilities
First published: Thu Aug 17 2023(Updated: )
It was discovered that PostgreSQL incorrectly handled certain extension script substitutions. An attacker having database-level CREATE privileges can use this issue to execute arbitrary code as the bootstrap superuser. (CVE-2023-39417) It was discovered that PostgreSQL incorrectly handled the MERGE command. A remote attacker could possibly use this issue to bypass certain UPDATE and SELECT policies. This issue only affected Ubuntu 23.04. (CVE-2023-39418)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/postgresql-15 | <15.4-0ubuntu0.23.04.1 | 15.4-0ubuntu0.23.04.1 |
| Ubuntu Ubuntu | =23.04 | |
| All of | ||
| ubuntu/postgresql-client-15 | <15.4-0ubuntu0.23.04.1 | 15.4-0ubuntu0.23.04.1 |
| Ubuntu Ubuntu | =23.04 | |
| All of | ||
| ubuntu/postgresql-14 | <14.9-0ubuntu0.22.04.1 | 14.9-0ubuntu0.22.04.1 |
| Ubuntu Ubuntu | =22.04 | |
| All of | ||
| ubuntu/postgresql-client-14 | <14.9-0ubuntu0.22.04.1 | 14.9-0ubuntu0.22.04.1 |
| Ubuntu Ubuntu | =22.04 | |
| All of | ||
| ubuntu/postgresql-12 | <12.16-0ubuntu0.20.04.1 | 12.16-0ubuntu0.20.04.1 |
| Ubuntu Ubuntu | =20.04 | |
| All of | ||
| ubuntu/postgresql-client-12 | <12.16-0ubuntu0.20.04.1 | 12.16-0ubuntu0.20.04.1 |
| Ubuntu Ubuntu | =20.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2023-39417
- https://ubuntu.com/security/CVE-2023-39418
- https://ubuntu.com/security/notices/USN-6366-1
- https://launchpad.net/ubuntu/+source/postgresql-15/15.4-0ubuntu0.23.04.1
- https://launchpad.net/ubuntu/+source/postgresql-14/14.9-0ubuntu0.22.04.1
- https://launchpad.net/ubuntu/+source/postgresql-12/12.16-0ubuntu0.20.04.1
- https://ubuntu.com/security/notices/USN-6296-1 (Advisory)
Frequently Asked Questions
What is the vulnerability ID?
CVE-2023-39417
What is the severity of CVE-2023-39417?
High
How can an attacker exploit CVE-2023-39417?
An attacker with database-level CREATE privileges can use the vulnerability to execute arbitrary code as the bootstrap superuser.
Which software is affected by CVE-2023-39417?
PostgreSQL versions 15.4, 14.9, and 12.16 on Ubuntu 23.04, 22.04, and 20.04 are affected.
How do I fix CVE-2023-39417?
Update to the latest PostgreSQL packages provided by Ubuntu.
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- collector/usn
- source/Ubuntu
- anchor-related/USN-6366-1
- agent/software-canonical-lookup
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/23.04
- version/ubuntu ubuntu/22.04
- version/ubuntu ubuntu/20.04