1. Ubuntu Security Notices
  2. USN-6802-1

USN-6802-1: PostgreSQL vulnerability

Publication date

30 May 2024

Overview

PostgreSQL could be made to expose sensitive information.

Releases

Packages

Details

Lukas Fittl discovered that PostgreSQL incorrectly performed authorization
in the built-in pg_stats_ext and pg_stats_ext_exprs views. An unprivileged
database user can use this issue to read most common values and other
statistics from CREATE STATISTICS commands of other users.

NOTE: This update will only fix fresh PostgreSQL installations. Current
PostgreSQL installations will remain vulnerable to this issue until manual
steps are performed. Please see the instructions in the changelog located
at /usr/share/doc/postgresql-*/changelog.Debian.gz after the updated
packages have been installed, or in the PostgreSQL release notes located
here:

https://www.postgresql.org/docs/16/release-16-3.html
https://www.postgresql.org/docs/15/release-15-7.html

Lukas Fittl discovered that PostgreSQL incorrectly performed authorization
in the built-in pg_stats_ext and pg_stats_ext_exprs views. An unprivileged
database user can use this issue to read most common values and other
statistics from CREATE STATISTICS commands of other users.

NOTE: This update will only fix fresh PostgreSQL installations. Current
PostgreSQL installations will remain vulnerable to this issue until manual
steps are performed. Please see the instructions in the changelog located
at /usr/share/doc/postgresql-*/changelog.Debian.gz after the updated
packages have been installed, or in the PostgreSQL release notes located
here:

https://www.postgresql.org/docs/16/release-16-3.html
https://www.postgresql.org/docs/15/release-15-7.html
https://www.postgresql.org/docs/14/release-14-12.html

Update instructions

This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart PostgreSQL to make all the necessary changes, and possibly perform manual steps as described above.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
24.04 noble postgresql-16 –  16.3-0ubuntu0.24.04.1
postgresql-client-16 –  16.3-0ubuntu0.24.04.1
23.10 mantic postgresql-15 –  15.7-0ubuntu0.23.10.1
postgresql-client-15 –  15.7-0ubuntu0.23.10.1
22.04 jammy postgresql-14 –  14.12-0ubuntu0.22.04.1
postgresql-client-14 –  14.12-0ubuntu0.22.04.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›