rpm package
suse/postgresql14&distro=SUSE Enterprise Storage 7
pkg:rpm/suse/postgresql14&distro=SUSE%20Enterprise%20Storage%207
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-2455 | — | < 14.8-150200.5.26.1 | 14.8-150200.5.26.1 | Jun 9, 2023 | Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happe | ||
| CVE-2023-2454 | — | < 14.8-150200.5.26.1 | 14.8-150200.5.26.1 | Jun 9, 2023 | schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code. | ||
| CVE-2022-41862 | — | < 14.7-150200.5.23.1 | 14.7-150200.5.23.1 | Mar 3, 2023 | In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes. | ||
| CVE-2022-1552 | — | < 14.3-150200.5.12.2 | 14.3-150200.5.12.2 | Aug 31, 2022 | A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protecti | ||
| CVE-2022-2625 | — | < 14.5-150200.5.17.1 | 14.5-150200.5.17.1 | Aug 18, 2022 | A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim |
- CVE-2023-2455Jun 9, 2023affected < 14.8-150200.5.26.1fixed 14.8-150200.5.26.1
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happe
- CVE-2023-2454Jun 9, 2023affected < 14.8-150200.5.26.1fixed 14.8-150200.5.26.1
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
- CVE-2022-41862Mar 3, 2023affected < 14.7-150200.5.23.1fixed 14.7-150200.5.23.1
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.
- CVE-2022-1552Aug 31, 2022affected < 14.3-150200.5.12.2fixed 14.3-150200.5.12.2
A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protecti
- CVE-2022-2625Aug 18, 2022affected < 14.5-150200.5.17.1fixed 14.5-150200.5.17.1
A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim