Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Ubuntu:Pro:14.04:LTS postgresql-9.3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:16.04:LTS postgresql-9.5

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:18.04:LTS postgresql-10

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:20.04:LTS postgresql-12

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:22.04:LTS postgresql-14

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.24-0ubuntu0.22.04.1"}]}]

Ubuntu:24.04:LTS postgresql-16

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-0ubuntu0.24.04.1"}]}]

Ubuntu:26.04:LTS postgresql-18

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-0ubuntu0.26.04.1"}]}]

参照URL

advisory ubuntu.com
report ubuntu.com
report cve.org
report postgresql.org
report postgresql.org