Security update for postgresql94 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0506-1 Final 1 1 2018-02-21T08:04:11Z current 2018-02-21T08:04:11Z 2018-02-21T08:04:11Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postgresql94 This update for postgresql94 fixes the following issues: PostgreSQL was updated to version 9.4.16, full release notes: https://www.postgresql.org/docs/9.4/static/release-9-4-16.html Security issues fixed: - CVE-2018-1053: Ensure that all temporary files made by pg_upgrade are non-world-readable. (bsc#1077983) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-postgresql94-13478,slessp4-postgresql94-13478 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180506-1/ Link for SUSE-SU-2018:0506-1 https://lists.suse.com/pipermail/sle-security-updates/2018-February/003745.html E-Mail link for SUSE-SU-2018:0506-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1077983 SUSE Bug 1077983 https://www.suse.com/security/cve/CVE-2018-1053/ SUSE CVE CVE-2018-1053 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 postgresql94-devel-9.4.16-0.23.13.2 libecpg6-9.4.16-0.23.13.2 libpq5-9.4.16-0.23.13.2 libpq5-32bit-9.4.16-0.23.13.2 postgresql94-9.4.16-0.23.13.2 postgresql94-contrib-9.4.16-0.23.13.2 postgresql94-docs-9.4.16-0.23.13.2 postgresql94-server-9.4.16-0.23.13.2 libecpg6-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Server 11 SP4 libpq5-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Server 11 SP4 libpq5-32bit-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Server 11 SP4 postgresql94-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Server 11 SP4 postgresql94-contrib-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Server 11 SP4 postgresql94-docs-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Server 11 SP4 postgresql94-server-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Server 11 SP4 libecpg6-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libpq5-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libpq5-32bit-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 postgresql94-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 postgresql94-contrib-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 postgresql94-docs-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 postgresql94-server-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 postgresql94-devel-9.4.16-0.23.13.2 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file. CVE-2018-1053 SUSE Linux Enterprise Server 11 SP4:libecpg6-9.4.16-0.23.13.2 SUSE Linux Enterprise Server 11 SP4:libpq5-32bit-9.4.16-0.23.13.2 SUSE Linux Enterprise Server 11 SP4:libpq5-9.4.16-0.23.13.2 SUSE Linux Enterprise Server 11 SP4:postgresql94-9.4.16-0.23.13.2 SUSE Linux Enterprise Server 11 SP4:postgresql94-contrib-9.4.16-0.23.13.2 SUSE Linux Enterprise Server 11 SP4:postgresql94-docs-9.4.16-0.23.13.2 SUSE Linux Enterprise Server 11 SP4:postgresql94-server-9.4.16-0.23.13.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libecpg6-9.4.16-0.23.13.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpq5-32bit-9.4.16-0.23.13.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpq5-9.4.16-0.23.13.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-9.4.16-0.23.13.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-contrib-9.4.16-0.23.13.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-docs-9.4.16-0.23.13.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:postgresql94-server-9.4.16-0.23.13.2 SUSE Linux Enterprise Software Development Kit 11 SP4:postgresql94-devel-9.4.16-0.23.13.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180506-1/ https://www.suse.com/security/cve/CVE-2018-1053.html CVE-2018-1053 https://bugzilla.suse.com/1077983 SUSE Bug 1077983 https://bugzilla.suse.com/1185814 SUSE Bug 1185814