USN-6538-1
- Source
- https://ubuntu.com/security/notices/USN-6538-1
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6538-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/USN-6538-1
- Upstream
- Related
- Published
- 2023-12-06T15:11:27.356147Z
- Modified
- 2025-10-13T04:36:43Z
- Summary
- postgresql-12, postgresql-14, postgresql-15 vulnerabilities
- Details
-
Jingzhou Fu discovered that PostgreSQL incorrectly handled certain unknown arguments in aggregate function calls. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2023-5868)
Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying certain SQL array values. A remote attacker could use this issue to obtain sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)
Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL allowed the pgsignalbackend role to signal certain superuser processes, contrary to expectations. (CVE-2023-5870)
- References
Affected packages
Ubuntu:20.04:LTS / postgresql-12
Package
- Name
- postgresql-12
- Purl
- pkg:deb/ubuntu/postgresql-12@12.17-0ubuntu0.20.04.1?arch=source&distro=focal
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed12.17-0ubuntu0.20.04.1
Affected versions
12.*
12.0-1
12.1-1
12.1-2build1
12.2-1
12.2-1ubuntu2
12.2-4
12.4-0ubuntu0.20.04.1
12.5-0ubuntu0.20.04.1
12.6-0ubuntu0.20.04.1
12.7-0ubuntu0.20.04.1
12.8-0ubuntu0.20.04.1
12.9-0ubuntu0.20.04.1
12.10-0ubuntu0.20.04.1
12.11-0ubuntu0.20.04.1
12.12-0ubuntu0.20.04.1
12.13-0ubuntu0.20.04.1
12.14-0ubuntu0.20.04.1
12.15-0ubuntu0.20.04.1
12.16-0ubuntu0.20.04.1
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_version": "12.17-0ubuntu0.20.04.1",
"binary_name": "libecpg-compat3"
},
{
"binary_version": "12.17-0ubuntu0.20.04.1",
"binary_name": "libecpg-dev"
},
{
"binary_version": "12.17-0ubuntu0.20.04.1",
"binary_name": "libecpg6"
},
{
"binary_version": "12.17-0ubuntu0.20.04.1",
"binary_name": "libpgtypes3"
},
{
"binary_version": "12.17-0ubuntu0.20.04.1",
"binary_name": "libpq-dev"
},
{
"binary_version": "12.17-0ubuntu0.20.04.1",
"binary_name": "libpq5"
},
{
"binary_version": "12.17-0ubuntu0.20.04.1",
"binary_name": "postgresql-12"
},
{
"binary_version": "12.17-0ubuntu0.20.04.1",
"binary_name": "postgresql-client-12"
},
{
"binary_version": "12.17-0ubuntu0.20.04.1",
"binary_name": "postgresql-doc-12"
},
{
"binary_version": "12.17-0ubuntu0.20.04.1",
"binary_name": "postgresql-plperl-12"
},
{
"binary_version": "12.17-0ubuntu0.20.04.1",
"binary_name": "postgresql-plpython3-12"
},
{
"binary_version": "12.17-0ubuntu0.20.04.1",
"binary_name": "postgresql-pltcl-12"
},
{
"binary_version": "12.17-0ubuntu0.20.04.1",
"binary_name": "postgresql-server-dev-12"
}
]
}
Database specific
{
"cves_map": {
"ecosystem": "Ubuntu:20.04:LTS",
"cves": [
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2023-5868"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2023-5869"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2023-5870"
}
]
}
}
Ubuntu:22.04:LTS / postgresql-14
Package
- Name
- postgresql-14
- Purl
- pkg:deb/ubuntu/postgresql-14@14.10-0ubuntu0.22.04.1?arch=source&distro=jammy
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed14.10-0ubuntu0.22.04.1
Affected versions
14.*
14.1-1ubuntu1
14.2-1
14.2-1ubuntu1
14.3-0ubuntu0.22.04.1
14.4-0ubuntu0.22.04.1
14.5-0ubuntu0.22.04.1
14.6-0ubuntu0.22.04.1
14.7-0ubuntu0.22.04.1
14.8-0ubuntu0.22.04.1
14.9-0ubuntu0.22.04.1
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_version": "14.10-0ubuntu0.22.04.1",
"binary_name": "libecpg-compat3"
},
{
"binary_version": "14.10-0ubuntu0.22.04.1",
"binary_name": "libecpg-dev"
},
{
"binary_version": "14.10-0ubuntu0.22.04.1",
"binary_name": "libecpg6"
},
{
"binary_version": "14.10-0ubuntu0.22.04.1",
"binary_name": "libpgtypes3"
},
{
"binary_version": "14.10-0ubuntu0.22.04.1",
"binary_name": "libpq-dev"
},
{
"binary_version": "14.10-0ubuntu0.22.04.1",
"binary_name": "libpq5"
},
{
"binary_version": "14.10-0ubuntu0.22.04.1",
"binary_name": "postgresql-14"
},
{
"binary_version": "14.10-0ubuntu0.22.04.1",
"binary_name": "postgresql-client-14"
},
{
"binary_version": "14.10-0ubuntu0.22.04.1",
"binary_name": "postgresql-doc-14"
},
{
"binary_version": "14.10-0ubuntu0.22.04.1",
"binary_name": "postgresql-plperl-14"
},
{
"binary_version": "14.10-0ubuntu0.22.04.1",
"binary_name": "postgresql-plpython3-14"
},
{
"binary_version": "14.10-0ubuntu0.22.04.1",
"binary_name": "postgresql-pltcl-14"
},
{
"binary_version": "14.10-0ubuntu0.22.04.1",
"binary_name": "postgresql-server-dev-14"
}
]
}
Database specific
{
"cves_map": {
"ecosystem": "Ubuntu:22.04:LTS",
"cves": [
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2023-5868"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2023-5869"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2023-5870"
}
]
}
}