Debian alert DLA-4646-1 (postgresql-13)

From:
             
 
Emmanuel Arias <eamanu@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4646-1] postgresql-13 security update
Date:
             
 
Wed, 24 Jun 2026 15:24:10 -0300
Message-ID:
             
 
<ajwgyvfX-XNPoj6B@debian>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4646-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Emmanuel Arias
June 24, 2026                                 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : postgresql-13
Version        : 13.23-0+deb11u4
CVE ID         : CVE-2026-6473 CVE-2026-6474 CVE-2026-6475 CVE-2026-6477 
                 CVE-2026-6478 CVE-2026-6479 CVE-2026-6637
Debian Bug     : 

Brief introduction 

CVE-2026-6473

    Integer wraparound in multiple PostgreSQL server features allows an
    application input provider to cause the server to undersize an allocation
    and write out-of-bounds.

CVE-2026-6474

    Externally-controlled format string in PostgreSQL timeofday() function
    allows an attacker to retrieve portions of server memory, via crafted
    timezone zones

CVE-2026-6475

    Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind
    allows an origin superuser to overwrite local files, that hijack the
    operating system account. It will remain the case that starting the server
    after these commands implicitly trusts the origin superuser, due to features
    like shared_preload_libraries.

CVE-2026-6477

    Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in
    PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64()
    functions allows the server superuser to overwrite a client stack buffer
    with an arbitrarily-large response.

CVE-2026-6478

    Covert timing channel in comparison of MD5-hashed password in PostgreSQL
    authentication allows an attacker to recover user credentials sufficient to
    authenticate. This does not affect scram-sha-256 passwords, the default in
    all supported releases. However, current databases may have MD5-hashed
    passwords originating in upgrades from PostgreSQL 13 or earlier.


CVE-2026-6479

    Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an
    attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained
    denial of service. If SSL and GSS are both disabled, an attacker can do the
    same via access to a PostgreSQL TCP socket

CVE-2026-6637

    Stack buffer overflow in PostgreSQL module refint allows an unprivileged
    database user to execute arbitrary code as the operating system user running
    the database. A distinct attack is possible if the application declares a
    user-controlled column as a refint cascade primary key and facilitates
    user-controlled updates to that column. In that case, a SQL injection allows
    a primary key update value provider to execute arbitrary SQL as the database
    user performing the primary key update.

For Debian 11 bullseye, these problems have been fixed in version
13.23-0+deb11u4.

We recommend that you upgrade your postgresql-13 packages.

For the detailed security status of postgresql-13 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/postgresql-13

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEE3lnVbvHK7ir4q61+p3sXeEcY/EFAmo8IMkACgkQ+p3sXeEc
Y/GAZRAAg11v9CKdPRbQP7lMyuLAvzs7jbXHxmBhO+WAJveH4Um6N4vakyOX+BDq
J6ffF6Ph9aTtHo4YqQYXM2L1PKcNp2BsT1kvbLjNN7wvPVx03kXPT3W+vw6qTfrq
nf1YIER4CWN9nigdVIKdLbNbpfPFf7wIMm6fqcXS2zpaoM9XVr0hBvq8Vc0er0oh
p7OLH4vI2mP7Ukn3Dxr8kLcIoUVfr6JQ0nK0salo0TEtvJF6PAfS3zRXUK/YHtSu
QORGnVb7GlEWNumeOAFHgMwrN2ALdH2kJGNb/3/i7pmksFbVavtgNW9wcRwVO8t0
s/88Wui82akPWNXAc5v/6vVtrItAymECIvv17HKl3uKm3Exoh+0jR44Etoqz6tL8
4hnb8zUjcOX+qQKlD/i2AbAVbfJMHR6nHNlk+bBH54PeV2OIQ5eFDHTQyxeSZVmV
+C+cz6tTk5Q0Dxh5BsLUWOFufZxiq1CtUAtbLvCqL0aeIJpyT0kJ+7ISvxaHl9UC
GnjE5iCedgDGzSxyJHHQDa3KdbhSFqyuJqPkO0Wm36TLyBjMjW4ZTPfvoMm+7vql
eUCANIESTbFbkMtc6SEJZG2g37K4KE5M/yMaVLRLAnPQB+8eVrEdphEhtfGzu/dg
VNmb6YjJZ+WNapj6gK6JMekOdGi5pAQc0LSZ+tbitjmwpcFKJFw=
=STNx
-----END PGP SIGNATURE-----