Anolis OS update for postgresql

Published: 2023-12-01 | Updated: 2025-03-29

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2023-39417 CVE-2023-39418
CWE-ID	CWE-89 CWE-264
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Anolis OS Operating systems & Components / Operating system postgresql-test-rpm-macros Operating systems & Components / Operating system package or component postgresql-upgrade-devel Operating systems & Components / Operating system package or component postgresql-upgrade Operating systems & Components / Operating system package or component postgresql-test Operating systems & Components / Operating system package or component postgresql-static Operating systems & Components / Operating system package or component postgresql-server-devel Operating systems & Components / Operating system package or component postgresql-server Operating systems & Components / Operating system package or component postgresql-private-libs Operating systems & Components / Operating system package or component postgresql-private-devel Operating systems & Components / Operating system package or component postgresql-pltcl Operating systems & Components / Operating system package or component postgresql-plpython3 Operating systems & Components / Operating system package or component postgresql-plperl Operating systems & Components / Operating system package or component postgresql-docs Operating systems & Components / Operating system package or component postgresql-contrib Operating systems & Components / Operating system package or component postgresql Operating systems & Components / Operating system package or component
Vendor	OpenAnolis

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) SQL injection

EUVDB-ID: #VU79454

Risk: Medium

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-39417

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data within the extension script @substitutions@, which uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Anolis OS: 23

postgresql-test-rpm-macros: before 15.4-1

postgresql-upgrade-devel: before 15.4-1

postgresql-upgrade: before 15.4-1

postgresql-test: before 15.4-1

postgresql-static: before 15.4-1

postgresql-server-devel: before 15.4-1

postgresql-server: before 15.4-1

postgresql-private-libs: before 15.4-1

postgresql-private-devel: before 15.4-1

postgresql-pltcl: before 15.4-1

postgresql-plpython3: before 15.4-1

postgresql-plperl: before 15.4-1

postgresql-docs: before 15.4-1

postgresql-contrib: before 15.4-1

postgresql: before 15.4-1

CPE2.3

External links

https://anas.openanolis.cn/errata/detail/ANSA-2023:0733

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU79455

Risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-39418

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls