From nobody Thu Aug 10 14:13:27 2023 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4RM86H3ngxz4mKg4; Thu, 10 Aug 2023 14:13:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4RM86H3GcXz3W6Y; Thu, 10 Aug 2023 14:13:27 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1691676807; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/g03A0JQGNXolhYzASzQeiGzOehVgyD7V83vFxRyGE0=; b=Db06lwXKuXsKIZRGUzci/Q7sLcHaF/NNZE+K8Zk35xR3IebeekQG079MCgEpnbFmuzKnR1 eCL1ecqG3z++aPqqkY2NwNft8pypSzHYuIVgU09dsQKsV20RG+UfkaVNGXjgqMkN0jwX5d HG9BJnDPELSMMKvJUZ97HHFLswDSlSZoqH2aYPzCkB2GGZDhwEUPIwxQdLVuTpBwKJTvwQ AZ6PN3lu5QMMvlLSOg3rc3/Lo0fkuMD/2iLNgBuMingZ7klNIXkx2dyHRNOCrR/PljiKor aulYubG7hAX4xwn4nxhKeU5LGE70f4qaOhzRGLHhiY8uBO9HKOXCADzRH8dUrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1691676807; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/g03A0JQGNXolhYzASzQeiGzOehVgyD7V83vFxRyGE0=; b=oMcE+jtYEt3F3L30+Bwqbpvp+Ionpb4jULHd6Ax//GYN2OB7RUNUKkREroTU4GvOYcIQsQ m3lxrZgIkbfm5ObbAzqu3QGI4rVzX/oVp3VjpXf5TlpPSogG7saonN8C8zlc3k7RUAd/XJ 2yh2UL6I3PiB6zJzrh4jpxLqp96U2tJReHXaoj0CVn1KDIWKb0u0e3KSxPEo59pIKbx7KQ zSyil/p4nOvK9YZo0WUWtDoE/r5MI51UXNdomUBRhFWt6l1pe5i3hnvbLGZCGoBE1XPIT1 2xYW4UUmmY/OKYHtkWZCSACCby9yVTTwncDmFJHlMQuQROzYzWWrimN4tjpgDg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1691676807; a=rsa-sha256; cv=none; b=t4fxJW73rrQ/0s5zp5+0wMfjVaTfyctR5H8YZVGU633Th0e8L/pC/HLMYQHPNaHun32HZ6 Nnnp742rJm4oH0gSCDLhCAVWiOq1VJ6B0zOIXHFI5U4O/I//YOZ5YZXE0I9ZjsvF74/KkH jGFdN5d50AUTdK0N6jP/p9pDQkyKm1cuWyJ3oILqxAW2LM4pOsroU+rCcg6B7PuvSaIotM ZdjGaCgAaJzmEi5zeQ10uGim1PJcNDDSrRuBnS2SW78FBKlmd9htUsK9q2O/WeMSazOAXj utTg8nQf9BAE9b37kU57zJWUDFlBK1B7jfusYqPAmx+U6VQAyu/84DjdEdz9Pw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4RM86H2M2Wz10Xr; Thu, 10 Aug 2023 14:13:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 37AEDRZR008959; Thu, 10 Aug 2023 14:13:27 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 37AEDRsa008956; Thu, 10 Aug 2023 14:13:27 GMT (envelope-from git) Date: Thu, 10 Aug 2023 14:13:27 GMT Message-Id: <202308101413.37AEDRsa008956@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Palle Girgensohn Subject: git: ef15f677b7f0 - main - security/vuxml: Add CVEs for PostgreSQL List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: girgen X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: ef15f677b7f084a6db6cb39d4240dd548cfbed92 Auto-Submitted: auto-generated The branch main has been updated by girgen: URL: https://cgit.FreeBSD.org/ports/commit/?id=ef15f677b7f084a6db6cb39d4240dd548cfbed92 commit ef15f677b7f084a6db6cb39d4240dd548cfbed92 Author: Palle Girgensohn AuthorDate: 2023-08-10 14:07:51 +0000 Commit: Palle Girgensohn CommitDate: 2023-08-10 14:13:24 +0000 security/vuxml: Add CVEs for PostgreSQL --- security/vuxml/vuln/2023.xml | 76 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 76 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index dfd44e052ad3..e49dd97848e1 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,79 @@ + + postgresql-server -- MERGE fails to enforce UPDATE or SELECT row security policies + + + postgresql-server + 15.4 + + + + +

PostgreSQL Project reports

+
+

+ PostgreSQL 15 introduced the MERGE command, which fails to test + new rows against row security policies defined for UPDATE and + SELECT. If UPDATE and SELECT policies forbid some row that + INSERT policies do not forbid, a user could store such rows. + Subsequent consequences are application-dependent. This + affects only databases that have used CREATE POLICY to define + a row security policy. +

+
+ + + + CVE-2023-39418 + https://www.postgresql.org/support/security/CVE-2023-39418/ + + + 2023-08-10 + 2023-08-10 + + + + + postgresql-server -- Extension script @substitutions@ within quoting allow SQL injection + + + postgresql-server + 11.21 + 12.16 + 13.12 + 14.9 + 15.4 + + + + +

PostgreSQL Project reports

+
+

+ An extension script is vulnerable if it uses @extowner@, + @extschema@, or @extschema:...@ inside a quoting construct + (dollar quoting, '', or ""). No bundled extension is + vulnerable. Vulnerable uses do appear in a documentation + example and in non-bundled extensions. Hence, the attack + prerequisite is an administrator having installed files of a + vulnerable, trusted, non-bundled extension. Subject to that + prerequisite, this enables an attacker having database-level + CREATE privilege to execute arbitrary code as the bootstrap + superuser. PostgreSQL will block this attack in the core + server, so there's no need to modify individual extensions. +

+
+ + + + CVE-2023-39417 + https://www.postgresql.org/support/security/CVE-2023-39417/ + + + 2023-08-10 + 2023-08-10 + + + electron{23,24,25} -- multiple vulnerabilities