Security update for postgresql, postgresql96, postgresql10, postgresql12 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2020:1228-1 Final 1 1 2020-08-17T14:19:12Z current 2020-08-17T14:19:12Z 2020-08-17T14:19:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postgresql, postgresql96, postgresql10, postgresql12 This update for postgresql, postgresql96, postgresql10, postgresql12 fixes the following issues: Postgresql12 was updated to 12.3 (bsc#1171924). - https://www.postgresql.org/about/news/2038/ - https://www.postgresql.org/docs/12/release-12-3.html - Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get a clean and complete cutover to the new packaging schema. Also changed in the postgresql wrapper package: - Bump version to 12.0.1, so that the binary packages also have a cut-point to conflict with. - Conflict with versions of the binary packages prior to the May 2020 update, because we changed the package layout at that point and need a clean cutover. - Bump package version to 12, but leave default at 10 for SLE-15 and SLE-15-SP1. postgresql11 was updated to 11.9: * CVE-2020-14349, bsc#1175193: Set a secure search_path in logical replication walsenders and apply workers * CVE-2020-14350, bsc#1175194: Make contrib modules' installation scripts more secure. * https://www.postgresql.org/docs/11/release-11-9.html - Pack the /usr/lib/postgresql symlink only into the main package. postgresql11 was updated to 11.8 (bsc#1171924). * https://www.postgresql.org/about/news/2038/ * https://www.postgresql.org/docs/11/release-11-8.html - Unify the spec file to work across all current PostgreSQL versions to simplify future maintenance. - Move from the 'libs' build flavour to a 'mini' package that will only be used inside the build service and not get shipped, to avoid confusion with the debuginfo packages (bsc#1148643). postgresql10 was updated to 10.13 (bsc#1171924). - https://www.postgresql.org/about/news/2038/ - https://www.postgresql.org/docs/10/release-10-13.html - Unify the spec file to work across all current PostgreSQL versions to simplify future maintenance. - Move from the 'libs' build flavour to a 'mini' package that will only be used inside the build service and not get shipped, to avoid confusion with the debuginfo packages (bsc#1148643). postgresql96 was updated to 9.6.19: * CVE-2020-14350, boo#1175194: Make contrib modules' installation scripts more secure. * https://www.postgresql.org/docs/9.6/release-9-6-19.html - Pack the /usr/lib/postgresql symlink only into the main package. - Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get a clean and complete cutover to the new packaging schema. - update to 9.6.18 (boo#1171924). https://www.postgresql.org/about/news/2038/ https://www.postgresql.org/docs/9.6/release-9-6-18.html - Unify the spec file to work across all current PostgreSQL versions to simplify future maintenance. - Move from the 'libs' build flavour to a 'mini' package that will only be used inside the build service and not get shipped, to avoid confusion with the debuginfo packages (boo#1148643). This update was imported from the SUSE:SLE-15-SP2:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2020-1228 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RVKTSYB6VOWNCXMN2C6CHUQBVHCRICIH/ E-Mail link for openSUSE-SU-2020:1228-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1148643 SUSE Bug 1148643 https://bugzilla.suse.com/1171924 SUSE Bug 1171924 https://bugzilla.suse.com/1175193 SUSE Bug 1175193 https://bugzilla.suse.com/1175194 SUSE Bug 1175194 https://www.suse.com/security/cve/CVE-2020-14349/ SUSE CVE CVE-2020-14349 page https://www.suse.com/security/cve/CVE-2020-14350/ SUSE CVE CVE-2020-14350 page openSUSE Leap 15.2 libecpg6-12.3-lp152.3.4.1 libecpg6-32bit-12.3-lp152.3.4.1 libpq5-12.3-lp152.3.4.1 libpq5-32bit-12.3-lp152.3.4.1 postgresql-12.0.1-lp152.3.3.2 postgresql-contrib-12.0.1-lp152.3.3.2 postgresql-devel-12.0.1-lp152.3.3.2 postgresql-docs-12.0.1-lp152.3.3.2 postgresql-llvmjit-12.0.1-lp152.3.3.2 postgresql-plperl-12.0.1-lp152.3.3.2 postgresql-plpython-12.0.1-lp152.3.3.2 postgresql-pltcl-12.0.1-lp152.3.3.2 postgresql-server-12.0.1-lp152.3.3.2 postgresql-server-devel-12.0.1-lp152.3.3.2 postgresql-test-12.0.1-lp152.3.3.2 postgresql10-10.13-lp152.2.3.1 postgresql10-contrib-10.13-lp152.2.3.1 postgresql10-devel-10.13-lp152.2.3.1 postgresql10-docs-10.13-lp152.2.3.1 postgresql10-plperl-10.13-lp152.2.3.1 postgresql10-plpython-10.13-lp152.2.3.1 postgresql10-pltcl-10.13-lp152.2.3.1 postgresql10-server-10.13-lp152.2.3.1 postgresql10-test-10.13-lp152.2.3.1 postgresql11-11.9-lp152.3.3.1 postgresql11-contrib-11.9-lp152.3.3.1 postgresql11-devel-11.9-lp152.3.3.1 postgresql11-docs-11.9-lp152.3.3.1 postgresql11-llvmjit-11.9-lp152.3.3.1 postgresql11-plperl-11.9-lp152.3.3.1 postgresql11-plpython-11.9-lp152.3.3.1 postgresql11-pltcl-11.9-lp152.3.3.1 postgresql11-server-11.9-lp152.3.3.1 postgresql11-server-devel-11.9-lp152.3.3.1 postgresql11-test-11.9-lp152.3.3.1 postgresql12-12.3-lp152.3.4.1 postgresql12-contrib-12.3-lp152.3.4.1 postgresql12-devel-12.3-lp152.3.4.1 postgresql12-docs-12.3-lp152.3.4.1 postgresql12-llvmjit-12.3-lp152.3.4.1 postgresql12-plperl-12.3-lp152.3.4.1 postgresql12-plpython-12.3-lp152.3.4.1 postgresql12-pltcl-12.3-lp152.3.4.1 postgresql12-server-12.3-lp152.3.4.1 postgresql12-server-devel-12.3-lp152.3.4.1 postgresql12-test-12.3-lp152.3.4.1 postgresql96-9.6.19-lp152.2.3.1 postgresql96-contrib-9.6.19-lp152.2.3.1 postgresql96-devel-9.6.19-lp152.2.3.1 postgresql96-docs-9.6.19-lp152.2.3.1 postgresql96-plperl-9.6.19-lp152.2.3.1 postgresql96-plpython-9.6.19-lp152.2.3.1 postgresql96-pltcl-9.6.19-lp152.2.3.1 postgresql96-server-9.6.19-lp152.2.3.1 postgresql96-test-9.6.19-lp152.2.3.1 libecpg6-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 libecpg6-32bit-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 libpq5-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 libpq5-32bit-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 postgresql-12.0.1-lp152.3.3.2 as a component of openSUSE Leap 15.2 postgresql-contrib-12.0.1-lp152.3.3.2 as a component of openSUSE Leap 15.2 postgresql-devel-12.0.1-lp152.3.3.2 as a component of openSUSE Leap 15.2 postgresql-docs-12.0.1-lp152.3.3.2 as a component of openSUSE Leap 15.2 postgresql-llvmjit-12.0.1-lp152.3.3.2 as a component of openSUSE Leap 15.2 postgresql-plperl-12.0.1-lp152.3.3.2 as a component of openSUSE Leap 15.2 postgresql-plpython-12.0.1-lp152.3.3.2 as a component of openSUSE Leap 15.2 postgresql-pltcl-12.0.1-lp152.3.3.2 as a component of openSUSE Leap 15.2 postgresql-server-12.0.1-lp152.3.3.2 as a component of openSUSE Leap 15.2 postgresql-server-devel-12.0.1-lp152.3.3.2 as a component of openSUSE Leap 15.2 postgresql-test-12.0.1-lp152.3.3.2 as a component of openSUSE Leap 15.2 postgresql10-10.13-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql10-contrib-10.13-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql10-devel-10.13-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql10-docs-10.13-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql10-plperl-10.13-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql10-plpython-10.13-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql10-pltcl-10.13-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql10-server-10.13-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql10-test-10.13-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql11-11.9-lp152.3.3.1 as a component of openSUSE Leap 15.2 postgresql11-contrib-11.9-lp152.3.3.1 as a component of openSUSE Leap 15.2 postgresql11-devel-11.9-lp152.3.3.1 as a component of openSUSE Leap 15.2 postgresql11-docs-11.9-lp152.3.3.1 as a component of openSUSE Leap 15.2 postgresql11-llvmjit-11.9-lp152.3.3.1 as a component of openSUSE Leap 15.2 postgresql11-plperl-11.9-lp152.3.3.1 as a component of openSUSE Leap 15.2 postgresql11-plpython-11.9-lp152.3.3.1 as a component of openSUSE Leap 15.2 postgresql11-pltcl-11.9-lp152.3.3.1 as a component of openSUSE Leap 15.2 postgresql11-server-11.9-lp152.3.3.1 as a component of openSUSE Leap 15.2 postgresql11-server-devel-11.9-lp152.3.3.1 as a component of openSUSE Leap 15.2 postgresql11-test-11.9-lp152.3.3.1 as a component of openSUSE Leap 15.2 postgresql12-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 postgresql12-contrib-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 postgresql12-devel-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 postgresql12-docs-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 postgresql12-llvmjit-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 postgresql12-plperl-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 postgresql12-plpython-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 postgresql12-pltcl-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 postgresql12-server-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 postgresql12-server-devel-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 postgresql12-test-12.3-lp152.3.4.1 as a component of openSUSE Leap 15.2 postgresql96-9.6.19-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql96-contrib-9.6.19-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql96-devel-9.6.19-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql96-docs-9.6.19-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql96-plperl-9.6.19-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql96-plpython-9.6.19-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql96-pltcl-9.6.19-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql96-server-9.6.19-lp152.2.3.1 as a component of openSUSE Leap 15.2 postgresql96-test-9.6.19-lp152.2.3.1 as a component of openSUSE Leap 15.2 It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication. CVE-2020-14349 openSUSE Leap 15.2:libecpg6-12.3-lp152.3.4.1 openSUSE Leap 15.2:libecpg6-32bit-12.3-lp152.3.4.1 openSUSE Leap 15.2:libpq5-12.3-lp152.3.4.1 openSUSE Leap 15.2:libpq5-32bit-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-contrib-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-devel-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-docs-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-llvmjit-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-plperl-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-plpython-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-pltcl-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-server-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-server-devel-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-test-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql10-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-contrib-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-devel-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-docs-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-plperl-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-plpython-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-pltcl-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-server-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-test-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql11-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-contrib-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-devel-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-docs-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-llvmjit-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-plperl-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-plpython-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-pltcl-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-server-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-server-devel-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-test-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql12-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-contrib-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-devel-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-docs-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-llvmjit-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-plperl-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-plpython-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-pltcl-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-server-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-server-devel-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-test-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql96-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-contrib-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-devel-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-docs-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-plperl-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-plpython-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-pltcl-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-server-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-test-9.6.19-lp152.2.3.1 important 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RVKTSYB6VOWNCXMN2C6CHUQBVHCRICIH/ https://www.suse.com/security/cve/CVE-2020-14349.html CVE-2020-14349 https://bugzilla.suse.com/1175193 SUSE Bug 1175193 https://bugzilla.suse.com/1176151 SUSE Bug 1176151 https://bugzilla.suse.com/1179499 SUSE Bug 1179499 https://bugzilla.suse.com/1179870 SUSE Bug 1179870 It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. CVE-2020-14350 openSUSE Leap 15.2:libecpg6-12.3-lp152.3.4.1 openSUSE Leap 15.2:libecpg6-32bit-12.3-lp152.3.4.1 openSUSE Leap 15.2:libpq5-12.3-lp152.3.4.1 openSUSE Leap 15.2:libpq5-32bit-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-contrib-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-devel-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-docs-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-llvmjit-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-plperl-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-plpython-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-pltcl-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-server-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-server-devel-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql-test-12.0.1-lp152.3.3.2 openSUSE Leap 15.2:postgresql10-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-contrib-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-devel-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-docs-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-plperl-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-plpython-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-pltcl-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-server-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql10-test-10.13-lp152.2.3.1 openSUSE Leap 15.2:postgresql11-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-contrib-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-devel-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-docs-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-llvmjit-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-plperl-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-plpython-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-pltcl-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-server-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-server-devel-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql11-test-11.9-lp152.3.3.1 openSUSE Leap 15.2:postgresql12-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-contrib-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-devel-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-docs-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-llvmjit-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-plperl-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-plpython-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-pltcl-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-server-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-server-devel-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql12-test-12.3-lp152.3.4.1 openSUSE Leap 15.2:postgresql96-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-contrib-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-devel-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-docs-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-plperl-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-plpython-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-pltcl-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-server-9.6.19-lp152.2.3.1 openSUSE Leap 15.2:postgresql96-test-9.6.19-lp152.2.3.1 important 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RVKTSYB6VOWNCXMN2C6CHUQBVHCRICIH/ https://www.suse.com/security/cve/CVE-2020-14350.html CVE-2020-14350 https://bugzilla.suse.com/1175194 SUSE Bug 1175194 https://bugzilla.suse.com/1176151 SUSE Bug 1176151 https://bugzilla.suse.com/1179115 SUSE Bug 1179115 https://bugzilla.suse.com/1179499 SUSE Bug 1179499 https://bugzilla.suse.com/1179870 SUSE Bug 1179870