{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "PostgreSQL ist eine frei verf\u00fcgbare Datenbank f\u00fcr unterschiedliche Betriebssysteme.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX\n- Linux\n- MacOS X\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-1203 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1203.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-1203 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1203"
      },
      {
        "category": "external",
        "summary": "Postgres Release Notes vom 2023-05-11",
        "url": "https://www.postgresql.org/about/news/postgresql-153-148-1311-1215-and-1120-released-2637/"
      },
      {
        "category": "external",
        "summary": "Postgres Security Advisory vom 2023-05-11",
        "url": "https://www.postgresql.org/support/security/CVE-2023-2454/"
      },
      {
        "category": "external",
        "summary": "Postgres Security Advisory vom 2023-05-11",
        "url": "https://www.postgresql.org/support/security/CVE-2023-2455/"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-5401 vom 2023-05-13",
        "url": "https://www.debian.org/security/2023/dsa-5401"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-3422 vom 2023-05-15",
        "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00014.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2201-1 vom 2023-05-15",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-May/014890.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2198-1 vom 2023-05-15",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-May/014893.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2199-1 vom 2023-05-15",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-May/014892.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2200-1 vom 2023-05-15",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-May/014891.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2207-1 vom 2023-05-15",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-May/014885.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2206-1 vom 2023-05-15",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-May/014886.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2205-1 vom 2023-05-15",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-May/014887.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2202-1 vom 2023-05-15",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-May/014889.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:2219-1 vom 2023-05-16",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-May/014900.html"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-6104-1 vom 2023-05-24",
        "url": "https://ubuntu.com/security/notices/USN-6104-1"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2023-1759 vom 2023-06-09",
        "url": "https://alas.aws.amazon.com/ALAS-2023-1759.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-3714 vom 2023-06-22",
        "url": "https://linux.oracle.com/errata/ELSA-2023-3714.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3714 vom 2023-06-21",
        "url": "https://access.redhat.com/errata/RHSA-2023:3714"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-6230-1 vom 2023-07-13",
        "url": "https://ubuntu.com/security/notices/USN-6230-1"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4313 vom 2023-07-27",
        "url": "https://access.redhat.com/errata/RHSA-2023:4313"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4327 vom 2023-07-31",
        "url": "https://access.redhat.com/errata/RHSA-2023:4327"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-4327 vom 2023-08-02",
        "url": "https://linux.oracle.com/errata/ELSA-2023-4327.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4539 vom 2023-08-08",
        "url": "https://access.redhat.com/errata/RHSA-2023:4539"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4527 vom 2023-08-08",
        "url": "https://access.redhat.com/errata/RHSA-2023:4527"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:4535 vom 2023-08-08",
        "url": "https://access.redhat.com/errata/RHSA-2023:4535"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-4535 vom 2023-08-10",
        "url": "https://linux.oracle.com/errata/ELSA-2023-4535.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-4527 vom 2023-08-10",
        "url": "https://linux.oracle.com/errata/ELSA-2023-4527.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-4539 vom 2023-08-11",
        "url": "https://linux.oracle.com/errata/ELSA-2023-4539.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:5269 vom 2023-09-19",
        "url": "https://access.redhat.com/errata/RHSA-2023:5269"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-5269 vom 2023-09-20",
        "url": "https://linux.oracle.com/errata/ELSA-2023-5269.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALASPOSTGRESQL14-2023-001 vom 2023-09-28",
        "url": "https://alas.aws.amazon.com/AL2/ALASPOSTGRESQL14-2023-001.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALASPOSTGRESQL13-2023-001 vom 2023-09-28",
        "url": "https://alas.aws.amazon.com/AL2/ALASPOSTGRESQL13-2023-001.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALASPOSTGRESQL12-2023-001 vom 2023-09-28",
        "url": "https://alas.aws.amazon.com/AL2/ALASPOSTGRESQL12-2023-001.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALASPOSTGRESQL11-2023-001 vom 2023-09-28",
        "url": "https://alas.aws.amazon.com/AL2/ALASPOSTGRESQL11-2023-001.html"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2023-143 vom 2023-10-03",
        "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-143/index.html"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2023-144 vom 2023-10-03",
        "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-144/index.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:7545 vom 2023-11-28",
        "url": "https://access.redhat.com/errata/RHSA-2023:7545"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:7580 vom 2023-11-29",
        "url": "https://access.redhat.com/errata/RHSA-2023:7580"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:7667 vom 2023-12-06",
        "url": "https://access.redhat.com/errata/RHSA-2023:7667"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:7666 vom 2023-12-06",
        "url": "https://access.redhat.com/errata/RHSA-2023:7666"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:7695 vom 2023-12-07",
        "url": "https://access.redhat.com/errata/RHSA-2023:7695"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:7694 vom 2023-12-07",
        "url": "https://access.redhat.com/errata/RHSA-2023:7694"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:7772 vom 2023-12-13",
        "url": "http://access.redhat.com/errata/RHSA-2023:7772"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2024-2462 vom 2024-02-19",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2024-2462.html"
      }
    ],
    "source_lang": "en-US",
    "title": "PostgreSQL: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-02-19T23:00:00.000+00:00",
      "generator": {
        "date": "2024-02-20T10:06:35.445+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2023-1203",
      "initial_release_date": "2023-05-11T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-05-11T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-05-14T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2023-05-15T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-05-16T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-05-24T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2023-06-08T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2023-06-21T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen"
        },
        {
          "date": "2023-07-13T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2023-07-27T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-07-31T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-08-01T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2023-08-08T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-08-09T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2023-08-13T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2023-09-19T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-09-20T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2023-09-27T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2023-10-03T22:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von HITACHI aufgenommen"
        },
        {
          "date": "2023-11-28T23:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-11-29T23:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-12-06T23:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-12-12T23:00:00.000+00:00",
          "number": "22",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-02-19T23:00:00.000+00:00",
          "number": "23",
          "summary": "Neue Updates von Amazon aufgenommen"
        }
      ],
      "status": "final",
      "version": "23"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c Common Services 10.9.3-00",
                "product": {
                  "name": "Hitachi Ops Center \u003c Common Services 10.9.3-00",
                  "product_id": "T030195",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hitachi:ops_center:common_services_10.9.3-00"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c Analyzer 10.9.3-00",
                "product": {
                  "name": "Hitachi Ops Center \u003c Analyzer 10.9.3-00",
                  "product_id": "T030196",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hitachi:ops_center:analyzer_10.9.3-00"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c Viewpoint 10.9.3-00",
                "product": {
                  "name": "Hitachi Ops Center \u003c Viewpoint 10.9.3-00",
                  "product_id": "T030197",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hitachi:ops_center:viewpoint_10.9.3-00"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Ops Center"
          }
        ],
        "category": "vendor",
        "name": "Hitachi"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 15.3",
                "product": {
                  "name": "Open Source PostgreSQL \u003c 15.3",
                  "product_id": "T027706",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:postgresql:postgresql:15.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c 14.8",
                "product": {
                  "name": "Open Source PostgreSQL \u003c 14.8",
                  "product_id": "T027707",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:postgresql:postgresql:14.8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c 13.11",
                "product": {
                  "name": "Open Source PostgreSQL \u003c 13.11",
                  "product_id": "T027708",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:postgresql:postgresql:13.11"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c 12.15",
                "product": {
                  "name": "Open Source PostgreSQL \u003c 12.15",
                  "product_id": "T027709",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:postgresql:postgresql:12.15"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c 11.20",
                "product": {
                  "name": "Open Source PostgreSQL \u003c 11.20",
                  "product_id": "T027710",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:postgresql:postgresql:11.20"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "PostgreSQL"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-2454",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in PostgreSQL. Es ist m\u00f6glich den gesetzten Suchpfad zu \u00e4ndern, wodurch Codeausf\u00fchrung erm\u00f6glicht wird. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T004914",
          "T030196",
          "T030195",
          "T030197"
        ]
      },
      "release_date": "2023-05-11T22:00:00Z",
      "title": "CVE-2023-2454"
    },
    {
      "cve": "CVE-2023-2455",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in PostgreSQL. Diese ist auf einen Fehler bei der Einhaltung von Security Policies nach einer \u00c4nderung der User ID zur\u00fcckzuf\u00fchren. Es ist dadurch m\u00f6glich einem User eine fehlerhafte Security Policy zuzuweisen. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T004914",
          "T030196",
          "T030195",
          "T030197"
        ]
      },
      "release_date": "2023-05-11T22:00:00Z",
      "title": "CVE-2023-2455"
    }
  ]
}