ALT-PU-2026-11785

Критический

ALT-PU-2026-11785: package postgresql14-pg_partman update to version 5.5.0-alt1

Источник

errata.altlinux.org

Дата публикации

30.07.2026

Дата обновления

30.07.2026

Устраненные уязвимости

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades postgresql14-pg_partman to version 5.5.0-alt1.

Устраненные уязвимости7

CVE-2026-61781

Критический 9.9

Дата публикации: 18.09.2026

CWE-89

CWE-269

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_bgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pg_partman_bgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.

CVSS 3.1

Критический 9.9

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Ссылки

CVE-2026-61781 https://nvd.nist.gov/vuln/detail/CVE-2026-61781

Ссылки1

ALT-PU-2026-11785 https://errata.altlinux.org/ALT-PU-2026-11785

Связанные уязвимости

ALT-PU-2026-11787

CVSS3: 9.9

altlinux

3 месяца назад

ALT-PU-2026-11787: package `postgresql15-pg_partman` update to version 5.5.0-alt1

ALT-PU-2026-11786

CVSS3: 9.9

altlinux

3 месяца назад

ALT-PU-2026-11786: package `postgresql16-pg_partman` update to version 5.5.0-alt1

ALT-PU-2026-11783

CVSS3: 9.9

altlinux

3 месяца назад

ALT-PU-2026-11783: package `postgresql17-pg_partman` update to version 5.5.0-alt1

ALT-PU-2026-11427

CVSS3: 9.9

altlinux

3 месяца назад

ALT-PU-2026-11427: package `postgresql18-pg_partman` update to version 5.5.0-alt1

ALT-PU-2026-11426

CVSS3: 9.9

altlinux

3 месяца назад

ALT-PU-2026-11426: package `postgresql15-pg_partman` update to version 5.5.0-alt1