git: 6e7190b6dcc4 - main - security/vuxml: add issues for PostgreSQL

From: Palle Girgensohn <girgen_at_FreeBSD.org>
Date: Thu, 09 Nov 2023 15:10:32 UTC
The branch main has been updated by girgen:

URL: https://cgit.FreeBSD.org/ports/commit/?id=6e7190b6dcc418f3e78d506fbc3c755b7bf751f1

commit 6e7190b6dcc418f3e78d506fbc3c755b7bf751f1
Author:     Palle Girgensohn <girgen@FreeBSD.org>
AuthorDate: 2023-11-09 15:06:03 +0000
Commit:     Palle Girgensohn <girgen@FreeBSD.org>
CommitDate: 2023-11-09 15:07:59 +0000

    security/vuxml: add issues for PostgreSQL
    
    https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/
---
 security/vuxml/vuln/2023.xml | 122 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 122 insertions(+)

diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml
index 50d3fc6b5a20..de081674c39c 100644
--- a/security/vuxml/vuln/2023.xml
+++ b/security/vuxml/vuln/2023.xml
@@ -1,3 +1,125 @@
+  <vuln vid="31f45d06-7f0e-11ee-94b4-6cc21735f730">
+    <topic>postgresql-server -- Memory disclosure in aggregate function calls</topic>
+    <affects>
+      <package>
+	<name>postgresql-server</name>
+	<range><lt>16.1</lt></range>
+	<range><lt>15.5</lt></range>
+	<range><lt>14.10</lt></range>
+	<range><lt>13.13</lt></range>
+	<range><lt>12.17</lt></range>
+	<range><lt>11.22</lt></range>
+      </package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>PostgreSQL Project reports:</p>
+	<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-5868/">
+	  <p>
+	    Certain aggregate function calls receiving "unknown"-type
+	    arguments could disclose bytes of server memory from the end of
+	    the "unknown"-type value to the next zero byte. One typically
+	    gets an "unknown"-type value via a string literal having no type
+	    designation. We have not confirmed or ruled out viability of
+	    attacks that arrange for presence of notable, confidential
+	    information in disclosed bytes.
+	  </p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2023-5868</cvename>
+      <url>https://www.postgresql.org/support/security/CVE-2023-5868/</url>
+    </references>
+    <dates>
+      <discovery>2023-11-09</discovery>
+      <entry>2023-11-09</entry>
+    </dates>
+  </vuln>
+
+  <vuln vid="0f445859-7f0e-11ee-94b4-6cc21735f730">
+    <topic>postgresql-server -- Buffer overrun from integer overflow in array modification</topic>
+    <affects>
+      <package>
+	<name>postgresql-server</name>
+	<range><lt>16.1</lt></range>
+	<range><lt>15.5</lt></range>
+	<range><lt>14.10</lt></range>
+	<range><lt>13.13</lt></range>
+	<range><lt>12.17</lt></range>
+	<range><lt>11.22</lt></range>
+      </package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>PostgreSQL Project reports:</p>
+	<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-5869/">
+	  <p>
+	    While modifying certain SQL array values, missing
+	    overflow checks let authenticated database users write
+	    arbitrary bytes to a memory area that facilitates
+	    arbitrary code execution. Missing overflow checks also
+	    let authenticated database users read a wide area of
+	    server memory. The CVE-2021-32027 fix covered some
+	    attacks of this description, but it missed others.
+	  </p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2023-5869</cvename>
+      <url>https://www.postgresql.org/support/security/CVE-2023-5869/</url>
+    </references>
+    <dates>
+      <discovery>2023-11-09</discovery>
+      <entry>2023-11-09</entry>
+    </dates>
+  </vuln>
+
+  <vuln vid="bbb18fcb-7f0d-11ee-94b4-6cc21735f730">
+    <topic>postgresql-server -- Role pg_cancel_backend can signal certain superuser processes</topic>
+    <affects>
+      <package>
+	<name>postgresql-server</name>
+	<range><lt>16.1</lt></range>
+	<range><lt>15.5</lt></range>
+	<range><lt>14.10</lt></range>
+	<range><lt>13.13</lt></range>
+	<range><lt>12.17</lt></range>
+	<range><lt>11.22</lt></range>
+      </package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>PostgreSQL Project reports:</p>
+	<blockquote cite="https://www.postgresql.org/support/security/CVE-2023-5870/">
+	  <p>
+	    Documentation says the pg_cancel_backend role cannot
+	    signal "a backend owned by a superuser". On the
+	    contrary, it can signal background workers, including
+	    the logical replication launcher. It can signal
+	    autovacuum workers and the autovacuum launcher.
+	    Signaling autovacuum workers and those two launchers
+	    provides no meaningful exploit, so exploiting this
+	    vulnerability requires a non-core extension with a
+	    less-resilient background worker. For example, a
+	    non-core background worker that does not auto-restart
+	    would experience a denial of service with respect to
+	    that particular background worker.
+	  </p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2023-5870</cvename>
+      <url>https://www.postgresql.org/support/security/CVE-2023-5870/</url>
+    </references>
+    <dates>
+      <discovery>2023-11-09</discovery>
+      <entry>2023-11-09</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="5558dded-a870-4fbe-8b0a-ba198db47007">
     <topic>electron{25,26} -- multiple vulnerabilities</topic>
     <affects>