openSUSE Security Update: Security update for postgresql, postgresql96, postgresql10, postgresql12
______________________________________________________________________________
Announcement ID: openSUSE-SU-2020:1228-1
Rating: moderate
References: #1148643 #1171924 #1175193 #1175194
Cross-References: CVE-2020-14349 CVE-2020-14350
Affected Products:
openSUSE Leap 15.2
______________________________________________________________________________
An update that solves two vulnerabilities and has two fixes
is now available.
Description:
This update for postgresql, postgresql96, postgresql10, postgresql12 fixes
the following issues:
Postgresql12 was updated to 12.3 (bsc#1171924).
– https://www.postgresql.org/about/news/2038/
– https://www.postgresql.org/docs/12/release-12-3.html
– Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get a clean
and complete cutover to the new packaging schema.
Also changed in the postgresql wrapper package:
– Bump version to 12.0.1, so that the binary packages also have a
cut-point to conflict with.
– Conflict with versions of the binary packages prior to the May 2020
update, because we changed the package layout at that point and need a
clean cutover.
– Bump package version to 12, but leave default at 10 for SLE-15 and
SLE-15-SP1.
postgresql11 was updated to 11.9:
* CVE-2020-14349, bsc#1175193: Set a secure search_path in logical
replication walsenders and apply workers
* CVE-2020-14350, bsc#1175194: Make contrib modules’ installation scripts
more secure.
* https://www.postgresql.org/docs/11/release-11-9.html
– Pack the /usr/lib/postgresql symlink only into the main package.
postgresql11 was updated to 11.8 (bsc#1171924).
* https://www.postgresql.org/about/news/2038/
* https://www.postgresql.org/docs/11/release-11-8.html
– Unify the spec file to work across all current PostgreSQL versions to
simplify future maintenance.
– Move from the “libs” build flavour to a “mini” package that will
only be used inside the build service and not get shipped, to avoid
confusion with the debuginfo packages (bsc#1148643).
postgresql10 was updated to 10.13 (bsc#1171924).
– https://www.postgresql.org/about/news/2038/
– https://www.postgresql.org/docs/10/release-10-13.html
– Unify the spec file to work across all current PostgreSQL versions to
simplify future maintenance.
– Move from the “libs” build flavour to a “mini” package that will
only be used inside the build service and not get shipped, to avoid
confusion with the debuginfo packages (bsc#1148643).
postgresql96 was updated to 9.6.19:
* CVE-2020-14350, boo#1175194: Make contrib modules’ installation
scripts more secure.
* https://www.postgresql.org/docs/9.6/release-9-6-19.html
– Pack the /usr/lib/postgresql symlink only into the main package.
– Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get a clean
and complete cutover to the new packaging schema.
– update to 9.6.18 (boo#1171924).
https://www.postgresql.org/about/news/2038/
https://www.postgresql.org/docs/9.6/release-9-6-18.html
– Unify the spec file to work across all current PostgreSQL versions to
simplify future maintenance.
– Move from the “libs” build flavour to a “mini” package that will
only be used inside the build service and not get shipped, to avoid
confusion with the debuginfo packages (boo#1148643).
This update was imported from the SUSE:SLE-15-SP2:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.
Alternatively you can run the command listed for your product:
– openSUSE Leap 15.2:
zypper in -t patch openSUSE-2020-1228=1
Package List:
– openSUSE Leap 15.2 (i586 x86_64):
libecpg6-12.3-lp152.3.4.1
libecpg6-debuginfo-12.3-lp152.3.4.1
libpq5-12.3-lp152.3.4.1
libpq5-debuginfo-12.3-lp152.3.4.1
postgresql10-10.13-lp152.2.3.1
postgresql10-contrib-10.13-lp152.2.3.1
postgresql10-contrib-debuginfo-10.13-lp152.2.3.1
postgresql10-debuginfo-10.13-lp152.2.3.1
postgresql10-debugsource-10.13-lp152.2.3.1
postgresql10-devel-10.13-lp152.2.3.1
postgresql10-devel-debuginfo-10.13-lp152.2.3.1
postgresql10-plperl-10.13-lp152.2.3.1
postgresql10-plperl-debuginfo-10.13-lp152.2.3.1
postgresql10-plpython-10.13-lp152.2.3.1
postgresql10-plpython-debuginfo-10.13-lp152.2.3.1
postgresql10-pltcl-10.13-lp152.2.3.1
postgresql10-pltcl-debuginfo-10.13-lp152.2.3.1
postgresql10-server-10.13-lp152.2.3.1
postgresql10-server-debuginfo-10.13-lp152.2.3.1
postgresql10-test-10.13-lp152.2.3.1
postgresql12-12.3-lp152.3.4.1
postgresql12-contrib-12.3-lp152.3.4.1
postgresql12-contrib-debuginfo-12.3-lp152.3.4.1
postgresql12-debuginfo-12.3-lp152.3.4.1
postgresql12-debugsource-12.3-lp152.3.4.1
postgresql12-devel-12.3-lp152.3.4.1
postgresql12-devel-debuginfo-12.3-lp152.3.4.1
postgresql12-llvmjit-12.3-lp152.3.4.1
postgresql12-llvmjit-debuginfo-12.3-lp152.3.4.1
postgresql12-plperl-12.3-lp152.3.4.1
postgresql12-plperl-debuginfo-12.3-lp152.3.4.1
postgresql12-plpython-12.3-lp152.3.4.1
postgresql12-plpython-debuginfo-12.3-lp152.3.4.1
postgresql12-pltcl-12.3-lp152.3.4.1
postgresql12-pltcl-debuginfo-12.3-lp152.3.4.1
postgresql12-server-12.3-lp152.3.4.1
postgresql12-server-debuginfo-12.3-lp152.3.4.1
postgresql12-server-devel-12.3-lp152.3.4.1
postgresql12-server-devel-debuginfo-12.3-lp152.3.4.1
postgresql12-test-12.3-lp152.3.4.1
postgresql96-9.6.19-lp152.2.3.1
postgresql96-contrib-9.6.19-lp152.2.3.1
postgresql96-contrib-debuginfo-9.6.19-lp152.2.3.1
postgresql96-debuginfo-9.6.19-lp152.2.3.1
postgresql96-debugsource-9.6.19-lp152.2.3.1
postgresql96-devel-9.6.19-lp152.2.3.1
postgresql96-devel-debuginfo-9.6.19-lp152.2.3.1
postgresql96-plperl-9.6.19-lp152.2.3.1
postgresql96-plperl-debuginfo-9.6.19-lp152.2.3.1
postgresql96-plpython-9.6.19-lp152.2.3.1
postgresql96-plpython-debuginfo-9.6.19-lp152.2.3.1
postgresql96-pltcl-9.6.19-lp152.2.3.1
postgresql96-pltcl-debuginfo-9.6.19-lp152.2.3.1
postgresql96-server-9.6.19-lp152.2.3.1
postgresql96-server-debuginfo-9.6.19-lp152.2.3.1
postgresql96-test-9.6.19-lp152.2.3.1
– openSUSE Leap 15.2 (noarch):
postgresql-12.0.1-lp152.3.3.2
postgresql-contrib-12.0.1-lp152.3.3.2
postgresql-devel-12.0.1-lp152.3.3.2
postgresql-docs-12.0.1-lp152.3.3.2
postgresql-llvmjit-12.0.1-lp152.3.3.2
postgresql-plperl-12.0.1-lp152.3.3.2
postgresql-plpython-12.0.1-lp152.3.3.2
postgresql-pltcl-12.0.1-lp152.3.3.2
postgresql-server-12.0.1-lp152.3.3.2
postgresql-server-devel-12.0.1-lp152.3.3.2
postgresql-test-12.0.1-lp152.3.3.2
postgresql10-docs-10.13-lp152.2.3.1
postgresql11-docs-11.9-lp152.3.3.1
postgresql12-docs-12.3-lp152.3.4.1
postgresql96-docs-9.6.19-lp152.2.3.1
– openSUSE Leap 15.2 (x86_64):
libecpg6-32bit-12.3-lp152.3.4.1
libecpg6-32bit-debuginfo-12.3-lp152.3.4.1
libpq5-32bit-12.3-lp152.3.4.1
libpq5-32bit-debuginfo-12.3-lp152.3.4.1
postgresql11-11.9-lp152.3.3.1
postgresql11-contrib-11.9-lp152.3.3.1
postgresql11-contrib-debuginfo-11.9-lp152.3.3.1
postgresql11-debuginfo-11.9-lp152.3.3.1
postgresql11-debugsource-11.9-lp152.3.3.1
postgresql11-devel-11.9-lp152.3.3.1
postgresql11-devel-debuginfo-11.9-lp152.3.3.1
postgresql11-llvmjit-11.9-lp152.3.3.1
postgresql11-llvmjit-debuginfo-11.9-lp152.3.3.1
postgresql11-plperl-11.9-lp152.3.3.1
postgresql11-plperl-debuginfo-11.9-lp152.3.3.1
postgresql11-plpython-11.9-lp152.3.3.1
postgresql11-plpython-debuginfo-11.9-lp152.3.3.1
postgresql11-pltcl-11.9-lp152.3.3.1
postgresql11-pltcl-debuginfo-11.9-lp152.3.3.1
postgresql11-server-11.9-lp152.3.3.1
postgresql11-server-debuginfo-11.9-lp152.3.3.1
postgresql11-server-devel-11.9-lp152.3.3.1
postgresql11-server-devel-debuginfo-11.9-lp152.3.3.1
postgresql11-test-11.9-lp152.3.3.1
References:
https://www.suse.com/security/cve/CVE-2020-14349.html
https://www.suse.com/security/cve/CVE-2020-14350.html
https://bugzilla.suse.com/1148643
https://bugzilla.suse.com/1171924
https://bugzilla.suse.com/1175193
https://bugzilla.suse.com/1175194
—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org
openSUSE Security Update: Security update for postgresql96, postgresql10 and postgresql12
______________________________________________________________________________
Announcement ID: openSUSE-SU-2020:1227-1
Rating: moderate
References: #1091610 #1104199 #1104202 #1134689 #1145092
#1148643 #1163985 #1171924 #1175194
Cross-References: CVE-2018-10915 CVE-2018-10925 CVE-2018-1115
CVE-2019-10130 CVE-2019-10208 CVE-2020-14350
CVE-2020-1720
Affected Products:
openSUSE Leap 15.1
______________________________________________________________________________
An update that solves 7 vulnerabilities and has two fixes
is now available.
Description:
This update for postgresql96, postgresql10 and postgresql12 fixes the
following issues:
postgresql10 was updated to 10.13 (bsc#1171924).
https://www.postgresql.org/about/news/2038/
https://www.postgresql.org/docs/10/release-10-13.html
postgresql10 was updated to 10.12 (CVE-2020-1720, bsc#1163985)
– https://www.postgresql.org/about/news/2011/
– https://www.postgresql.org/docs/10/release-10-12.html
postgresql10 was updated to 10.11:
– https://www.postgresql.org/about/news/1994/
– https://www.postgresql.org/docs/10/release-10-11.html
postgresql12 was updated to 12.3 (bsc#1171924).
Bug Fixes and Improvements:
– Several fixes for GENERATED columns, including an issue where it was
possible to crash or corrupt data in a table when the output of the
generated column was the exact copy of a physical column on the table,
e.g. if the expression called a function which could return its own
input.
– Several fixes for ALTER TABLE, including ensuring the SET STORAGE
directive is propagated to a table’s indexes.
– Fix a potential race condition when using DROP OWNED BY while another
session is deleting the same objects.
– Allow for a partition to be detached when it has inherited ROW triggers.
– Several fixes for REINDEX CONCURRENTLY, particularly with issues when a
REINDEX CONCURRENTLY operation fails.
– Fix crash when COLLATE is applied to an uncollatable type in a partition
bound expression.
– Fix performance regression in floating point overflow/underflow
detection.
– Several fixes for full text search, particularly with phrase searching.
– Fix query-lifespan memory leak for a set-returning function used in a
query’s FROM clause.
– Several reporting fixes for the output of VACUUM VERBOSE.
– Allow input of type circle to accept the format (x,y),r, which is
specified in the documentation.
– Allow for the get_bit() and set_bit() functions to not fail on bytea
strings longer than 256MB.
– Avoid premature recycling of WAL segments during crash recovery, which
could lead to WAL segments being recycled before being archived.
– Avoid attempting to fetch nonexistent WAL files from archive storage
during recovery by skipping irrelevant timelines.
– Several fixes for logical replication and replication slots.
– Fix several race conditions in synchronous standby management, including
one that occurred when changing the synchronous_standby_names setting.
– Several fixes for GSSAPI support, include a fix for a memory leak that
occurred when using GSSAPI encryption.
– Ensure that members of the pg_read_all_stats role can read all
statistics views.
– Fix performance regression in information_schema.triggers view.
– Fix memory leak in libpq when using sslmode=verify-full.
– Fix crash in psql when attempting to re-establish a failed connection.
– Allow tab-completion of the filename argument to \gx command in psql.
– Add pg_dump support for ALTER … DEPENDS ON EXTENSION.
– Several other fixes for pg_dump, which include dumping comments on RLS
policies and postponing restore of event triggers until the end.
– Ensure pg_basebackup generates valid tar files.
– pg_checksums skips tablespace subdirectories that belong to a different
PostgreSQL major version
– Several Windows compatibility fixes
This update also contains timezone tzdata release 2020a for DST law
changes in Morocco and the Canadian Yukon, plus historical corrections for
Shanghai. The America/Godthab zone has been renamed to America/Nuuk to
reflect current English usage ; however, the old name remains available as
a compatibility link. This also updates initdb’s list of known Windows
time zone names to include recent additions.
For more details, check out:
– https://www.postgresql.org/docs/12/release-12-3.html
Other fixes:
– Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get a clean
and complete cutover to the new packaging schema.
postgresql96 was updated to 9.6.19:
* CVE-2020-14350, boo#1175194: Make contrib modules’ installation
scripts more secure.
* https://www.postgresql.org/docs/9.6/release-9-6-19.html
– Pack the /usr/lib/postgresql symlink only into the main package.
– Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get a clean
and complete cutover to the new packaging schema.
– update to 9.6.18 (boo#1171924).
https://www.postgresql.org/about/news/2038/
https://www.postgresql.org/docs/9.6/release-9-6-18.html
– Unify the spec file to work across all current PostgreSQL versions to
simplify future maintenance.
– Move from the “libs” build flavour to a “mini” package that will
only be used inside the build service and not get shipped, to avoid
confusion with the debuginfo packages (boo#1148643).
– update to 9.6.17 (CVE-2020-1720, boo#1163985)
https://www.postgresql.org/about/news/2011/
https://www.postgresql.org/docs/9.6/release-9-6-17.html
– use and package the sha256 checksum for for source
– update to 9.6.16: https://www.postgresql.org/about/news/1994/
https://www.postgresql.org/docs/9.6/release-9-6-16.html
– add requires to the devel package for the libs that are returned by
pg_config –libs
– Update to 9.6.15:
* https://www.postgresql.org/about/news/1960/
* https://www.postgresql.org/docs/9.6/release-9-6-15.html
* CVE-2019-10208, boo#1145092: TYPE in pg_temp executes arbitrary SQL
during SECURITY DEFINER execution.
– Use FAT LTO objects in order to provide proper static library.
– Update to 9.6.14: https://www.postgresql.org/docs/9.6/release-9-6-14.html
– Update to 9.6.13:
* https://www.postgresql.org/docs/9.6/release-9-6-13.html
* https://www.postgresql.org/about/news/1939/
* CVE-2019-10130, boo#1134689: Prevent row-level security policies from
being bypassed via selectivity estimators.
– Make the server-devel package exclusive across versions.
– Update to 9.6.12:
* https://www.postgresql.org/docs/9.6/release-9-6-12.html
* https://www.postgresql.org/about/news/1920/
* By default, panic instead of retrying after fsync() failure, to avoid
possible data corruption.
* Numerous other bug fixes.
– Overhaul README.SUSE
– Update to 9.6.11:
* Numerous bug fixes, see the release notes:
https://www.postgresql.org/docs/9.6/release-9-6-11.html
* Remove unneeded library dependencies from PGXS.
– add provides for the new server-devel package that will be introduced in
postgresql 11
– Update to 9.6.10:
https://www.postgresql.org/docs/current/static/release-9-6-10.html
* CVE-2018-10915, boo#1104199: Fix failure to reset libpq’s state fully
between connection attempts.
* CVE-2018-10925, boo#1104202: Fix INSERT … ON CONFLICT UPDATE through
a view that isn’t just SELECT * FROM …
– Update to 9.6.9: https://www.postgresql.org/about/news/1851/
https://www.postgresql.org/docs/current/static/release-9-6-9.html A
dump/restore is not required for those running 9.6.X. However, if you
use the adminpack extension, you should update it as per the first
changelog entry below. Also, if the function marking mistakes mentioned
in the second and third changelog entries below affect you, you will
want to take steps to correct your database catalogs.
* CVE-2018-1115, boo#1091610: Remove public execute privilege from
contrib/adminpack’s pg_logfile_rotate() function pg_logfile_rotate()
is a deprecated wrapper for the core function pg_rotate_logfile().
When that function was changed to rely on SQL privileges for access
control rather than a hard-coded superuser check, pg_logfile_rotate()
should have been updated as well, but the need for this was missed.
Hence, if adminpack is installed, any user could request a logfile
rotation, creating a minor security issue. After installing this
update, administrators should update adminpack by performing ALTER
EXTENSION adminpack UPDATE in each database in which adminpack is
installed.
* Fix incorrect volatility markings on a few built-in functions
* Fix incorrect parallel-safety markings on a few built-in functions.
This update was imported from the SUSE:SLE-15-SP1:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.
Alternatively you can run the command listed for your product:
– openSUSE Leap 15.1:
zypper in -t patch openSUSE-2020-1227=1
Package List:
– openSUSE Leap 15.1 (i586 x86_64):
postgresql10-10.13-lp151.2.14.1
postgresql10-contrib-10.13-lp151.2.14.1
postgresql10-contrib-debuginfo-10.13-lp151.2.14.1
postgresql10-debuginfo-10.13-lp151.2.14.1
postgresql10-debugsource-10.13-lp151.2.14.1
postgresql10-devel-10.13-lp151.2.14.1
postgresql10-devel-debuginfo-10.13-lp151.2.14.1
postgresql10-plperl-10.13-lp151.2.14.1
postgresql10-plperl-debuginfo-10.13-lp151.2.14.1
postgresql10-plpython-10.13-lp151.2.14.1
postgresql10-plpython-debuginfo-10.13-lp151.2.14.1
postgresql10-pltcl-10.13-lp151.2.14.1
postgresql10-pltcl-debuginfo-10.13-lp151.2.14.1
postgresql10-server-10.13-lp151.2.14.1
postgresql10-server-debuginfo-10.13-lp151.2.14.1
postgresql10-test-10.13-lp151.2.14.1
postgresql96-9.6.19-lp151.3.3.1
postgresql96-contrib-9.6.19-lp151.3.3.1
postgresql96-contrib-debuginfo-9.6.19-lp151.3.3.1
postgresql96-debuginfo-9.6.19-lp151.3.3.1
postgresql96-debugsource-9.6.19-lp151.3.3.1
postgresql96-devel-9.6.19-lp151.3.3.1
postgresql96-devel-debuginfo-9.6.19-lp151.3.3.1
postgresql96-plperl-9.6.19-lp151.3.3.1
postgresql96-plperl-debuginfo-9.6.19-lp151.3.3.1
postgresql96-plpython-9.6.19-lp151.3.3.1
postgresql96-plpython-debuginfo-9.6.19-lp151.3.3.1
postgresql96-pltcl-9.6.19-lp151.3.3.1
postgresql96-pltcl-debuginfo-9.6.19-lp151.3.3.1
postgresql96-server-9.6.19-lp151.3.3.1
postgresql96-server-debuginfo-9.6.19-lp151.3.3.1
postgresql96-test-9.6.19-lp151.3.3.1
– openSUSE Leap 15.1 (x86_64):
libecpg6-12.3-lp151.2.1
libecpg6-debuginfo-12.3-lp151.2.1
libpq5-12.3-lp151.2.1
libpq5-debuginfo-12.3-lp151.2.1
postgresql12-12.3-lp151.2.1
postgresql12-contrib-12.3-lp151.2.1
postgresql12-contrib-debuginfo-12.3-lp151.2.1
postgresql12-debuginfo-12.3-lp151.2.1
postgresql12-debugsource-12.3-lp151.2.1
postgresql12-devel-12.3-lp151.2.1
postgresql12-devel-debuginfo-12.3-lp151.2.1
postgresql12-llvmjit-12.3-lp151.2.1
postgresql12-llvmjit-debuginfo-12.3-lp151.2.1
postgresql12-plperl-12.3-lp151.2.1
postgresql12-plperl-debuginfo-12.3-lp151.2.1
postgresql12-plpython-12.3-lp151.2.1
postgresql12-plpython-debuginfo-12.3-lp151.2.1
postgresql12-pltcl-12.3-lp151.2.1
postgresql12-pltcl-debuginfo-12.3-lp151.2.1
postgresql12-server-12.3-lp151.2.1
postgresql12-server-debuginfo-12.3-lp151.2.1
postgresql12-server-devel-12.3-lp151.2.1
postgresql12-server-devel-debuginfo-12.3-lp151.2.1
postgresql12-test-12.3-lp151.2.1
– openSUSE Leap 15.1 (noarch):
postgresql-12.0.1-lp151.6.9.1
postgresql-contrib-12.0.1-lp151.6.9.1
postgresql-devel-12.0.1-lp151.6.9.1
postgresql-docs-12.0.1-lp151.6.9.1
postgresql-llvmjit-12.0.1-lp151.6.9.1
postgresql-plperl-12.0.1-lp151.6.9.1
postgresql-plpython-12.0.1-lp151.6.9.1
postgresql-pltcl-12.0.1-lp151.6.9.1
postgresql-server-12.0.1-lp151.6.9.1
postgresql-server-devel-12.0.1-lp151.6.9.1
postgresql-test-12.0.1-lp151.6.9.1
postgresql10-docs-10.13-lp151.2.14.1
postgresql12-docs-12.3-lp151.2.1
postgresql96-docs-9.6.19-lp151.3.3.1
References:
https://www.suse.com/security/cve/CVE-2018-10915.html
https://www.suse.com/security/cve/CVE-2018-10925.html
https://www.suse.com/security/cve/CVE-2018-1115.html
https://www.suse.com/security/cve/CVE-2019-10130.html
https://www.suse.com/security/cve/CVE-2019-10208.html
https://www.suse.com/security/cve/CVE-2020-14350.html
https://www.suse.com/security/cve/CVE-2020-1720.html
https://bugzilla.suse.com/1091610
https://bugzilla.suse.com/1104199
https://bugzilla.suse.com/1104202
https://bugzilla.suse.com/1134689
https://bugzilla.suse.com/1145092
https://bugzilla.suse.com/1148643
https://bugzilla.suse.com/1163985
https://bugzilla.suse.com/1171924
https://bugzilla.suse.com/1175194
—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org
