Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-15741 →
DEBIAN-CVE-2026-15741
SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
postgresql-15
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.19-0+deb12u1"}]}]
Debian:13
postgresql-17
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.11-0+deb13u1"}]}]
Debian:14
postgresql-18
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1"}]}]
Références
- advisory security-tracker.debian.org