Amazon Linux 2023 Security Advisory: ALAS-2024-702
Advisory Release Date: 2024-08-14 19:14 Pacific
Advisory Updated Date: 2024-08-19 10:50 Pacific
Severity:
Important
Issue Overview:
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected. (CVE-2024-7348)
Affected Packages:
postgresql15
Issue Correction:
Run dnf update postgresql15 --releasever 2023.5.20240819 to update your system.
New Packages:
aarch64:
postgresql15-llvmjit-debuginfo-15.8-1.amzn2023.0.1.aarch64
postgresql15-plperl-15.8-1.amzn2023.0.1.aarch64
postgresql15-pltcl-15.8-1.amzn2023.0.1.aarch64
postgresql15-pltcl-debuginfo-15.8-1.amzn2023.0.1.aarch64
postgresql15-upgrade-devel-debuginfo-15.8-1.amzn2023.0.1.aarch64
postgresql15-plpython3-debuginfo-15.8-1.amzn2023.0.1.aarch64
postgresql15-test-15.8-1.amzn2023.0.1.aarch64
postgresql15-15.8-1.amzn2023.0.1.aarch64
postgresql15-upgrade-devel-15.8-1.amzn2023.0.1.aarch64
postgresql15-plpython3-15.8-1.amzn2023.0.1.aarch64
postgresql15-plperl-debuginfo-15.8-1.amzn2023.0.1.aarch64
postgresql15-private-devel-15.8-1.amzn2023.0.1.aarch64
postgresql15-contrib-15.8-1.amzn2023.0.1.aarch64
postgresql15-debuginfo-15.8-1.amzn2023.0.1.aarch64
postgresql15-private-libs-debuginfo-15.8-1.amzn2023.0.1.aarch64
postgresql15-test-debuginfo-15.8-1.amzn2023.0.1.aarch64
postgresql15-server-devel-debuginfo-15.8-1.amzn2023.0.1.aarch64
postgresql15-server-debuginfo-15.8-1.amzn2023.0.1.aarch64
postgresql15-contrib-debuginfo-15.8-1.amzn2023.0.1.aarch64
postgresql15-static-15.8-1.amzn2023.0.1.aarch64
postgresql15-upgrade-debuginfo-15.8-1.amzn2023.0.1.aarch64
postgresql15-private-libs-15.8-1.amzn2023.0.1.aarch64
postgresql15-docs-15.8-1.amzn2023.0.1.aarch64
postgresql15-docs-debuginfo-15.8-1.amzn2023.0.1.aarch64
postgresql15-server-devel-15.8-1.amzn2023.0.1.aarch64
postgresql15-llvmjit-15.8-1.amzn2023.0.1.aarch64
postgresql15-server-15.8-1.amzn2023.0.1.aarch64
postgresql15-upgrade-15.8-1.amzn2023.0.1.aarch64
postgresql15-debugsource-15.8-1.amzn2023.0.1.aarch64
noarch:
postgresql15-test-rpm-macros-15.8-1.amzn2023.0.1.noarch
src:
postgresql15-15.8-1.amzn2023.0.1.src
x86_64:
postgresql15-server-debuginfo-15.8-1.amzn2023.0.1.x86_64
postgresql15-docs-debuginfo-15.8-1.amzn2023.0.1.x86_64
postgresql15-debuginfo-15.8-1.amzn2023.0.1.x86_64
postgresql15-test-debuginfo-15.8-1.amzn2023.0.1.x86_64
postgresql15-pltcl-debuginfo-15.8-1.amzn2023.0.1.x86_64
postgresql15-15.8-1.amzn2023.0.1.x86_64
postgresql15-upgrade-devel-debuginfo-15.8-1.amzn2023.0.1.x86_64
postgresql15-plperl-debuginfo-15.8-1.amzn2023.0.1.x86_64
postgresql15-private-libs-debuginfo-15.8-1.amzn2023.0.1.x86_64
postgresql15-static-15.8-1.amzn2023.0.1.x86_64
postgresql15-pltcl-15.8-1.amzn2023.0.1.x86_64
postgresql15-plperl-15.8-1.amzn2023.0.1.x86_64
postgresql15-upgrade-devel-15.8-1.amzn2023.0.1.x86_64
postgresql15-llvmjit-debuginfo-15.8-1.amzn2023.0.1.x86_64
postgresql15-server-15.8-1.amzn2023.0.1.x86_64
postgresql15-upgrade-debuginfo-15.8-1.amzn2023.0.1.x86_64
postgresql15-server-devel-debuginfo-15.8-1.amzn2023.0.1.x86_64
postgresql15-contrib-debuginfo-15.8-1.amzn2023.0.1.x86_64
postgresql15-plpython3-debuginfo-15.8-1.amzn2023.0.1.x86_64
postgresql15-private-libs-15.8-1.amzn2023.0.1.x86_64
postgresql15-private-devel-15.8-1.amzn2023.0.1.x86_64
postgresql15-llvmjit-15.8-1.amzn2023.0.1.x86_64
postgresql15-plpython3-15.8-1.amzn2023.0.1.x86_64
postgresql15-docs-15.8-1.amzn2023.0.1.x86_64
postgresql15-test-15.8-1.amzn2023.0.1.x86_64
postgresql15-contrib-15.8-1.amzn2023.0.1.x86_64
postgresql15-server-devel-15.8-1.amzn2023.0.1.x86_64
postgresql15-upgrade-15.8-1.amzn2023.0.1.x86_64
postgresql15-debugsource-15.8-1.amzn2023.0.1.x86_64