[ GLSA 202003-03 ] PostgreSQL

[GLSA]

Gentoo Linux Security Advisory

Title: PostgreSQL: Multiple vulnerabilities (GLSA 202003-03)
Severity: normal
Exploitable: local, remote
Date: 2020-03-12
Bug(s): #685846, #688420, #709708
ID: 202003-03

Synopsis

Multiple vulnerabilities have been found in PostgreSQL, the worst
of which could result in the execution of arbitrary code.


Background

PostgreSQL is an open source object-relational database management
system.


Affected Packages

Package: dev-db/postgresql
Vulnerable: < 9.4.26
Vulnerable: < 9.5.21
Vulnerable: < 9.6.17
Vulnerable: < 10.12
Vulnerable: < 11.7
Vulnerable: < 12.2
Unaffected: >= 9.4.26
Unaffected: >= 9.5.21
Unaffected: >= 9.6.17
Unaffected: >= 10.12
Unaffected: >= 11.7
Unaffected: >= 12.2
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in PostgreSQL. Please
review the CVE identifiers referenced below for details.


Impact

A remote attacker could possibly execute arbitrary code with the
privileges of the process, bypass certain client-side connection security
features, read arbitrary server memory, alter certain data or cause a
Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All PostgreSQL 9.4.x users should upgrade to the latest version: