Security update for postgresql12

In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.

ELSA-2023-7016: libpq security update (LOW)

ELSA-2023-6429: libpq security update (LOW)

Уязвимость системы управления базами данных PostgreSQL, связанная с раскрытием информации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Security update for postgresql14

Security update for postgresql12

Security update for postgresql14

Security update for postgresql14

Security update for postgresql12

Security update for postgresql13

Security update for postgresql10

Security update for postgresql10

Security update for postgresql13

Moderate: postgresql:10 security update

Moderate: postgresql:12 security update

A vulnerability found in postgresql. On this security issue an attack requires permission to create non-temporary objects in at least one schema, ability to lure or wait for an administrator to create or update an affected extension in that schema, and ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, the attacker can run arbitrary code as the victim role, which may be a superuser. Known-affected extensions include both PostgreSQL-bundled and non-bundled extensions. PostgreSQL blocks this attack in the core server, so there's no need to modify individual extensions.

ELSA-2023-0113: postgresql:10 security update (MODERATE)

ELSA-2022-7128: postgresql:12 security update (MODERATE)

Уязвимость системы управления базами данных PostgreSQL, связанная с ошибками при использовании команд OR расширениями, позволяющая нарушителю повысить свои привилегии и заменить произвольные объекты в базе данных