[CLSA-2026:1788193166] Fix CVE(s): CVE-2026-6475
Type:
security
Severity:
Moderate
Release date:
2026-08-31 16:19:38 UTC
Description:
* SECURITY UPDATE: Path traversal in pg_rewind: file, directory and symlink paths received from the source server over libpq were acted on without validation, so a rogue origin could make pg_rewind write, truncate or unlink files outside the target data directory - debian/patches/CVE-2026-6475.patch: Add path_is_safe_for_extraction() in src/port/path.c, which canonicalises a path and requires it to stay relative and below the current directory, and gate every pg_rewind target file/dir/symlink operation on it with pg_fatal() (upstream commit 498829dca4; the pg_basebackup astreamer half of that commit is v15+ and absent from 9.6) - CVE-2026-6475: path traversal in pg_rewind target file operations via unvalidated paths supplied by the source server
CVEs fixed:
Updated packages:
  • libecpg-compat3-9.6_9.6.24-0+deb10u1+tuxcare.els5_amd64.deb
    sha:185ae2310787c4a3092e6205faa814b2b039bc87
  • libecpg-dev-9.6_9.6.24-0+deb10u1+tuxcare.els5_amd64.deb
    sha:c0f5151cdfd947f901bb6aac952a126ef6d2b472
  • libecpg6-9.6_9.6.24-0+deb10u1+tuxcare.els5_amd64.deb
    sha:c99a744766c65e729f544cf68702a22ad0c25185
  • libpgtypes3-9.6_9.6.24-0+deb10u1+tuxcare.els5_amd64.deb
    sha:29bb667effc75810f49a85eda826996eedc33e23
  • libpq-dev-9.6_9.6.24-0+deb10u1+tuxcare.els5_amd64.deb
    sha:fdc4de2e278f6d6b68e229f2a7fff6bd68edaedd
  • libpq5-9.6_9.6.24-0+deb10u1+tuxcare.els5_amd64.deb
    sha:73508bf72dec7e3a25433f5b0814a9509666b2b8
  • postgresql-9.6_9.6.24-0+deb10u1+tuxcare.els5_amd64.deb
    sha:98472f5f67a8c88f56a4287eb04f1e2c44ccf5d7
  • postgresql-client-9.6_9.6.24-0+deb10u1+tuxcare.els5_amd64.deb
    sha:8e5cec09409d2881ea2eea656ab680fedc0f7ffb
  • postgresql-contrib-9.6_9.6.24-0+deb10u1+tuxcare.els5_amd64.deb
    sha:c6492e8c1839893839fe7848fd5eec7185105c55
  • postgresql-doc-9.6_9.6.24-0+deb10u1+tuxcare.els5_all.deb
    sha:225fbbe1bfedf09ef74aaf7c02bd965015a939ce
  • postgresql-plperl-9.6_9.6.24-0+deb10u1+tuxcare.els5_amd64.deb
    sha:c108e57ce362bed6857de88c5860283728bbdcff
  • postgresql-plpython-9.6_9.6.24-0+deb10u1+tuxcare.els5_amd64.deb
    sha:f92dd6df4245c4d70b4d6e67ef27cea951bb0f21
  • postgresql-plpython3-9.6_9.6.24-0+deb10u1+tuxcare.els5_amd64.deb
    sha:a6e71d605c365b57d5f0c0b1328e5ac5bd367e12
  • postgresql-pltcl-9.6_9.6.24-0+deb10u1+tuxcare.els5_amd64.deb
    sha:8d3f9c6ec96c4d33b9bdc4f37ce19a6c7b23a306
  • postgresql-server-dev-9.6_9.6.24-0+deb10u1+tuxcare.els5_amd64.deb
    sha:d4ffe51b94c0bbc782151a313ae2e8d7065f7676
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.