PostgreSQL — свободная объектно-реляционная система управления базами данных.
Релизный цикл, информация об уязвимостях
График релизов
Релизные элементы
| KB | Версия | Билд | Дата доступности |
|---|---|---|---|
| 17.10 | 17.10 | ||
| 17.9 | 17.9 | ||
| 17.8 | 17.8 | ||
| 17.7 | 17.7 | ||
| 17.6 | 17.6 | ||
| 17.5 | 17.5 | ||
| 17.4 | 17.4 | ||
| 17.3 | 17.3 | ||
| 17.2 | 17.2 | ||
| 17.1 | 17.1 |
Показывать по
Количество 1 129
CVE-2023-2455
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
CVE-2023-2454
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
BDU:2023-03247
Уязвимость системы управления базами данных PostgreSQL, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код
BDU:2023-03024
Уязвимость компонента Schema Handler системы управления базами данных PostgreSQL, позволяющая нарушителю обойти ограничения безопасности
SUSE-SU-2023:0705-1
Security update for postgresql14
GHSA-fr68-cm8v-7vv6
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.
CVE-2022-41862
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.
CVE-2022-41862
In PostgreSQL, a modified, unauthenticated server can send an untermin ...
CVE-2022-41862
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.
SUSE-SU-2023:0583-1
Security update for postgresql13
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2023-2455 Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. | CVSS3: 4.2 | 1% Низкий | около 3 лет назад |
| CVE-2023-2454 schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code. | CVSS3: 7.2 | 1% Низкий | около 3 лет назад |
 | BDU:2023-03247 Уязвимость системы управления базами данных PostgreSQL, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код | CVSS3: 7.2 | 1% Низкий | около 3 лет назад |
| BDU:2023-03024 Уязвимость компонента Schema Handler системы управления базами данных PostgreSQL, позволяющая нарушителю обойти ограничения безопасности | CVSS3: 4.2 | 1% Низкий | около 3 лет назад |
 | SUSE-SU-2023:0705-1 Security update for postgresql14 | 1% Низкий | больше 3 лет назад | |
| GHSA-fr68-cm8v-7vv6 In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes. | CVSS3: 3.7 | 1% Низкий | больше 3 лет назад |
 | CVE-2022-41862 In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes. | CVSS3: 3.7 | 1% Низкий | больше 3 лет назад |
| CVE-2022-41862 In PostgreSQL, a modified, unauthenticated server can send an untermin ... | CVSS3: 3.7 | 1% Низкий | больше 3 лет назад |
 | CVE-2022-41862 In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes. | CVSS3: 3.7 | 1% Низкий | больше 3 лет назад |
| SUSE-SU-2023:0583-1 Security update for postgresql13 | 1% Низкий | больше 3 лет назад |
Уязвимостей на страницу