Bug 13572

Please patch CVEs for package postgresql version 12.14
  
INFO (CVEs are): postgresql 12.14
 cves found
CVE-2023-2454
Desc: schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-2454
Severity: HIGH
CVE-2023-2455
Desc: Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-2455
Severity: MEDIUM
CVE-2023-39417
Desc: IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-39417
Severity: HIGH