Security update for postgresql94 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1690-1 Final 1 1 2017-06-26T11:21:37Z current 2017-06-26T11:21:37Z 2017-06-26T11:21:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postgresql94 This update for postgresql94 to 9.4.12 fixes the following issues: Upstream changelogs: - https://www.postgresql.org/docs/9.4/static/release-9-4-12.html - https://www.postgresql.org/docs/9.4/static/release-9-4-11.html - https://www.postgresql.org/docs/9.4/static/release-9-4-10.html Security issues fixed: * CVE-2017-7486: Restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1037624) Please note that manual action is needed to fix this in existing databases See the upstream release notes for details. * CVE-2017-7485: recognize PGREQUIRESSL variable again. (bsc#1038293) * CVE-2017-7484: Prevent exposure of statistical information via leaky operators. (bsc#1037603) Changes in version 9.4.12: * Build corruption with CREATE INDEX CONCURRENTLY * Fixes for visibility and write-ahead-log stability Changes in version 9.4.10: * Fix WAL-logging of truncation of relation free space maps and visibility maps * Fix incorrect creation of GIN index WAL records on big-endian machines * Fix SELECT FOR UPDATE/SHARE to correctly lock tuples that have been updated by a subsequently-aborted transaction * Fix EvalPlanQual rechecks involving CTE scans * Fix improper repetition of previous results from hashed aggregation in a subquery The libraries libpq and libecpg are now supplied by postgresql 9.6. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP2-2017-1039,SUSE-SLE-RPI-12-SP2-2017-1039,SUSE-SLE-SDK-12-SP2-2017-1039,SUSE-SLE-SERVER-12-SP2-2017-1039 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171690-1/ Link for SUSE-SU-2017:1690-1 https://lists.suse.com/pipermail/sle-security-updates/2017-June/002981.html E-Mail link for SUSE-SU-2017:1690-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1037603 SUSE Bug 1037603 https://bugzilla.suse.com/1037624 SUSE Bug 1037624 https://bugzilla.suse.com/1038293 SUSE Bug 1038293 https://www.suse.com/security/cve/CVE-2017-7484/ SUSE CVE CVE-2017-7484 page https://www.suse.com/security/cve/CVE-2017-7485/ SUSE CVE CVE-2017-7485 page https://www.suse.com/security/cve/CVE-2017-7486/ SUSE CVE CVE-2017-7486 page SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP2 postgresql94-9.4.12-20.1 postgresql94-contrib-9.4.12-20.1 postgresql94-docs-9.4.12-20.1 postgresql94-server-9.4.12-20.1 postgresql94-devel-9.4.12-20.1 postgresql94-9.4.12-20.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 postgresql94-9.4.12-20.1 as a component of SUSE Linux Enterprise Server 12 SP2 postgresql94-contrib-9.4.12-20.1 as a component of SUSE Linux Enterprise Server 12 SP2 postgresql94-docs-9.4.12-20.1 as a component of SUSE Linux Enterprise Server 12 SP2 postgresql94-server-9.4.12-20.1 as a component of SUSE Linux Enterprise Server 12 SP2 postgresql94-9.4.12-20.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 postgresql94-contrib-9.4.12-20.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 postgresql94-docs-9.4.12-20.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 postgresql94-server-9.4.12-20.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 postgresql94-9.4.12-20.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql94-contrib-9.4.12-20.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql94-docs-9.4.12-20.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql94-server-9.4.12-20.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql94-devel-9.4.12-20.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access. CVE-2017-7484 SUSE Linux Enterprise Desktop 12 SP2:postgresql94-9.4.12-20.1 SUSE Linux Enterprise Server 12 SP2:postgresql94-9.4.12-20.1 SUSE Linux Enterprise Server 12 SP2:postgresql94-contrib-9.4.12-20.1 SUSE Linux Enterprise Server 12 SP2:postgresql94-docs-9.4.12-20.1 SUSE Linux Enterprise Server 12 SP2:postgresql94-server-9.4.12-20.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql94-9.4.12-20.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql94-contrib-9.4.12-20.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql94-docs-9.4.12-20.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql94-server-9.4.12-20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-9.4.12-20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-contrib-9.4.12-20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-docs-9.4.12-20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-server-9.4.12-20.1 SUSE Linux Enterprise Software Development Kit 12 SP2:postgresql94-devel-9.4.12-20.1 low 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171690-1/ https://www.suse.com/security/cve/CVE-2017-7484.html CVE-2017-7484 https://bugzilla.suse.com/1037603 SUSE Bug 1037603 https://bugzilla.suse.com/1051015 SUSE Bug 1051015 In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server. CVE-2017-7485 SUSE Linux Enterprise Desktop 12 SP2:postgresql94-9.4.12-20.1 SUSE Linux Enterprise Server 12 SP2:postgresql94-9.4.12-20.1 SUSE Linux Enterprise Server 12 SP2:postgresql94-contrib-9.4.12-20.1 SUSE Linux Enterprise Server 12 SP2:postgresql94-docs-9.4.12-20.1 SUSE Linux Enterprise Server 12 SP2:postgresql94-server-9.4.12-20.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql94-9.4.12-20.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql94-contrib-9.4.12-20.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql94-docs-9.4.12-20.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql94-server-9.4.12-20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-9.4.12-20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-contrib-9.4.12-20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-docs-9.4.12-20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-server-9.4.12-20.1 SUSE Linux Enterprise Software Development Kit 12 SP2:postgresql94-devel-9.4.12-20.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171690-1/ https://www.suse.com/security/cve/CVE-2017-7485.html CVE-2017-7485 https://bugzilla.suse.com/1038293 SUSE Bug 1038293 https://bugzilla.suse.com/1051015 SUSE Bug 1051015 PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server. CVE-2017-7486 SUSE Linux Enterprise Desktop 12 SP2:postgresql94-9.4.12-20.1 SUSE Linux Enterprise Server 12 SP2:postgresql94-9.4.12-20.1 SUSE Linux Enterprise Server 12 SP2:postgresql94-contrib-9.4.12-20.1 SUSE Linux Enterprise Server 12 SP2:postgresql94-docs-9.4.12-20.1 SUSE Linux Enterprise Server 12 SP2:postgresql94-server-9.4.12-20.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql94-9.4.12-20.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql94-contrib-9.4.12-20.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql94-docs-9.4.12-20.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql94-server-9.4.12-20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-9.4.12-20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-contrib-9.4.12-20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-docs-9.4.12-20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql94-server-9.4.12-20.1 SUSE Linux Enterprise Software Development Kit 12 SP2:postgresql94-devel-9.4.12-20.1 low 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171690-1/ https://www.suse.com/security/cve/CVE-2017-7486.html CVE-2017-7486 https://bugzilla.suse.com/1037624 SUSE Bug 1037624 https://bugzilla.suse.com/1051015 SUSE Bug 1051015 https://bugzilla.suse.com/1051685 SUSE Bug 1051685