Поиск уязвимостей

ALT-PU-2026-8091: package `postgresql15-1C` update to version 15.15-alt0.p10.5

ALT-PU-2026-7952: package `postgresql14` update to version 14.23-alt0.p10.1

ALT-PU-2026-7949: package `postgresql15` update to version 15.18-alt0.p10.1

ALT-PU-2026-7738: package `postgresql14` update to version 14.23-alt1

ALT-PU-2026-7736: package `postgresql15` update to version 15.18-alt1

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

Symlink following in PostgreSQL pg_basebackup plain format and in pg_r ...

ALT-PU-2026-7951: package `postgresql16` update to version 16.14-alt0.p10.1

ALT-PU-2026-7740: package `postgresql16` update to version 16.14-alt1

ALT-PU-2026-7953: package `postgresql17` update to version 17.10-alt0.p10.1

ALT-PU-2026-7948: package `postgresql17-1C` update to version 17.7-alt0.p11.7

ALT-PU-2026-7741: package `postgresql17` update to version 17.10-alt1

ALT-PU-2026-7946: package `postgresql18-1C` update to version 18.4-alt1

ALT-PU-2026-7739: package `postgresql18` update to version 18.4-alt1

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Important: postgresql:15 security update

Important: postgresql16 security update