[USN-6802-1] PostgreSQL vulnerability

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmZYjNIACgkQZWnYVadE
vpNjQw//ZLG6HK2rWn/13iO0qeusET7XMGc5HHKQCbnCdmzH5XKoOAnir42SGCgw
Ym1c09xYJfTLDZdvlIfuhkeSfe4uo50GEA+94/3riYGFc7YfXD0FlQxvNhCflrae
KJcingoe0XY7/a/r82pILMPPGo1Nz09RubycPax34FjT0oUEW+rG/wKu7pQk4msL
e2Hg+RdktSo8aRBO83H8G6r154X2E+NPPjHvawU/L/MNwUBfhkJ2nwMTKOyIhqCK
ouzteVApLUqFWicbE7edlm4ikFlXX2XtNzTMl/nCRobtVXy1+wWPNxuvfF1EaPs2
I0Kt+caOCOyAddQDyynk+paawH+hVjyIbkNK6wFrXBptjZ+l8vd26Fp3POQbFpt0
Kf2z8ZnT3ZVQmlpIqHvF4ZRaghNocVNu9THdwqyMy4w8/rFqS/ZrTFsyt8M6bSF/
OslPYZ6zhFeUgT++u99U95nkmTiKPaZwehm5DrlrEAAoq1isZM2+qu1aF2JJRz/B
xnfYhLgfTXSQbR4bhN3LMemxRP8xKu7SGk21n3tfDcTVJRbIi5hOGluD4m03rajl
SOum7uFwS/7EH+Eiu8/JITSG4CpFAHvy4QDrnBfOxap6Hi8hDRVdNdwXSH+gxYFy
ESr/ZGM+9BqGosyVljb6hxZNYWcDrU9XqFsWcN8TJXHf8Vulo0U=
=UYxs
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6802-1
May 30, 2024

postgresql-14, postgresql-15, postgresql-16 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 23.10
- Ubuntu 22.04 LTS

Summary:

PostgreSQL could be made to expose sensitive information.

Software Description:
- postgresql-16: Object-relational SQL database
- postgresql-15: Object-relational SQL database
- postgresql-14: Object-relational SQL database

Details:

Lukas Fittl discovered that PostgreSQL incorrectly performed authorization
in the built-in pg_stats_ext and pg_stats_ext_exprs views. An unprivileged
database user can use this issue to read most common values and other
statistics from CREATE STATISTICS commands of other users.

NOTE: This update will only fix fresh PostgreSQL installations. Current
PostgreSQL installations will remain vulnerable to this issue until manual
steps are performed. Please see the instructions in the changelog located
at /usr/share/doc/postgresql-*/changelog.Debian.gz after the updated
packages have been installed, or in the PostgreSQL release notes located
here:

https://www.postgresql.org/docs/16/release-16-3.html
https://www.postgresql.org/docs/15/release-15-7.html
https://www.postgresql.org/docs/14/release-14-12.html

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
postgresql-16 16.3-0ubuntu0.24.04.1
postgresql-client-16 16.3-0ubuntu0.24.04.1

Ubuntu 23.10
postgresql-15 15.7-0ubuntu0.23.10.1
postgresql-client-15 15.7-0ubuntu0.23.10.1

Ubuntu 22.04 LTS
postgresql-14 14.12-0ubuntu0.22.04.1
postgresql-client-14 14.12-0ubuntu0.22.04.1

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes, and possibly perform manual steps as
described above.

References:
https://ubuntu.com/security/notices/USN-6802-1
CVE-2024-4317

Package Information:
https://launchpad.net/ubuntu/+source/postgresql-16/16.3-0ubuntu0.24.04.1
https://launchpad.net/ubuntu/+source/postgresql-15/15.7-0ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/postgresql-14/14.12-0ubuntu0.22.04.1