Поиск уязвимостей

Уязвимость системы управления базами данных PostgreSQL, связанная с возможностью SQL-инъекций в расширениях, позволяющая нарушителю выполнять произвольный SQL-запрос к базе данных

Уязвимость PostgreSQL 15

Уязвимость PostgreSQL 14

ALT-PU-2023-4818: package `postgresql14` update to version 14.9-alt0.p10.1

ALT-PU-2023-4817: package `postgresql13` update to version 13.12-alt0.p10.1

ALT-PU-2023-4816: package `postgresql11` update to version 11.21-alt0.p10.1

ALT-PU-2023-4813: package `postgresql12` update to version 12.16-alt0.p10.1

ALT-PU-2023-4809: package `postgresql14` update to version 14.9-alt1

ALT-PU-2023-4808: package `postgresql13` update to version 13.12-alt1

ALT-PU-2023-4807: package `postgresql12` update to version 12.16-alt1

ALT-PU-2023-4806: package `postgresql11` update to version 11.21-alt1

ALT-PU-2023-4815: package `postgresql15` update to version 15.4-alt0.p10.1

ALT-PU-2023-4814: package `postgresql15-1C` update to version 15.3-alt0.p10.2

ALT-PU-2023-4810: package `postgresql15-1C` update to version 15.3-alt3

ALT-PU-2023-4805: package `postgresql15` update to version 15.4-alt1

Множественные уязвимости postgresql13

Множественные уязвимости postgresql

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.