Most recent entries from all

ALSA-2022:7128 — Moderate: postgresql:12 security update

Affected: AlmaLinux:8: pg_repack, AlmaLinux:8: pgaudit, AlmaLinux:8: postgres-decoderbufs, AlmaLinux:8: postgresql, AlmaLinux:8: postgresql-contrib, AlmaLinux:8: postgresql-docs, AlmaLinux:8: postgresql-plperl, AlmaLinux:8: postgresql-plpython3, AlmaLinux:8: postgresql-pltcl, AlmaLinux:8: postgresql-server and 6 more

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

* postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-04971

Withdrawn: BELL-CVE-2022-2625 — CVE-2022-2625 does not affect BellSoft software

Withdrawn by the publisher.

BIT-postgresql-2022-2625

Affected: Bitnami: postgresql

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

certfr-2022-avi-739 — De multiples vulnérabilités ont été découvertes dans PostgreSQL. Certaines d'entre elles permettent à un attaquant de p…

certfr-2022-avi-739

Withdrawn: CLEANSTART-2026-FW42039 — vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row secur…

Withdrawn by the publisher.

Affected: CleanStart: postgresql

Multiple security vulnerabilities affect the postgresql package. A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. See references for individual vulnerability details.

EUVD-2026-12461

fkie_cve-2022-2625

GHSA-m7mv-m566-78j6

A vulnerability found in postgresql. On this security issue an attack requires permission to create non-temporary objects in at least one schema, ability to lure or wait for an administrator to create or update an affected extension in that schema, and ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, the attacker can run arbitrary code as the victim role, which may be a superuser. Known-affected extensions include both PostgreSQL-bundled and non-bundled extensions. PostgreSQL blocks this attack in the core server, so there's no need to modify individual extensions.

gsd-2022-2625

openSUSE-SU-2024:12264-1 — postgresql10-10.22-1.1 on GA media

postgresql10-10.22-1.1 on GA media

RHSA-2023:0160 — Red Hat Security Advisory: rh-postgresql10-postgresql security and bug fix update

postgresql: Extension scripts replace objects not belonging to the extension.

SUSE-SU-2022:2893-1 — Security update for postgresql10

Security update for postgresql10

UBUNTU-CVE-2022-2625

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12, Ubuntu:22.04:LTS: postgresql-14

WID-SEC-W-2022-1013 — PostgreSQL: Schwachstelle ermöglicht Codeausführung

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in PostgreSQL ausnutzen, um beliebigen Programmcode auszuführen.