QID 352821

Package updates are available for amazon linux that fix the following vulnerabilities:
cve-2020-25695: a flaw was found in postgresql.
An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary sql functions under the identity of a superuser.
The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
1894425: cve-2020-25695 postgresql: multiple features escape "security restricted operation" sandbox cve-2019-10208: a flaw was discovered in postgresql where arbitrary sql statements can be executed given a suitable security definer function.
An attacker, with execute permission on the function, can execute arbitrary sql as the owner of the function.
1734416: cve-2019-10208 postgresql: type in pg_temp executes arbitrary sql during security definer execution


Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.