Security update for postgresql96 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0507-1 Final 1 1 2018-02-21T06:03:13Z current 2018-02-21T06:03:13Z 2018-02-21T06:03:13Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postgresql96 This update for postgresql96 to version 9.6.7 fixes the following issues: - CVE-2018-1053: Ensure that all temporary files made by pg_upgrade are non-world-readable. (bsc#1077983) A full changelog is available here: https://www.postgresql.org/docs/9.6/static/release-9-6-7.html The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP2-2018-332,SUSE-SLE-DESKTOP-12-SP3-2018-332,SUSE-SLE-RPI-12-SP2-2018-332,SUSE-SLE-SDK-12-SP2-2018-332,SUSE-SLE-SDK-12-SP3-2018-332,SUSE-SLE-SERVER-12-SP2-2018-332,SUSE-SLE-SERVER-12-SP3-2018-332 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180507-1/ Link for SUSE-SU-2018:0507-1 https://lists.suse.com/pipermail/sle-security-updates/2018-February/003746.html E-Mail link for SUSE-SU-2018:0507-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1077983 SUSE Bug 1077983 https://www.suse.com/security/cve/CVE-2018-1053/ SUSE CVE CVE-2018-1053 page SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 libecpg6-9.6.7-3.13.1 libpq5-9.6.7-3.13.1 libpq5-32bit-9.6.7-3.13.1 postgresql96-9.6.7-3.13.1 postgresql96-contrib-9.6.7-3.13.1 postgresql96-docs-9.6.7-3.13.1 postgresql96-server-9.6.7-3.13.1 postgresql96-devel-9.6.7-3.13.1 libecpg6-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libpq5-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libpq5-32bit-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 postgresql96-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libecpg6-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libpq5-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libpq5-32bit-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 postgresql96-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libecpg6-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server 12 SP2 libpq5-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server 12 SP2 libpq5-32bit-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server 12 SP2 postgresql96-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server 12 SP2 postgresql96-contrib-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server 12 SP2 postgresql96-docs-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server 12 SP2 postgresql96-server-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server 12 SP2 libecpg6-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server 12 SP3 libpq5-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server 12 SP3 libpq5-32bit-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server 12 SP3 postgresql96-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server 12 SP3 postgresql96-contrib-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server 12 SP3 postgresql96-docs-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server 12 SP3 postgresql96-server-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server 12 SP3 libecpg6-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libpq5-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 postgresql96-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 postgresql96-contrib-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 postgresql96-docs-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 postgresql96-server-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libecpg6-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libpq5-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libpq5-32bit-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql96-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql96-contrib-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql96-docs-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 postgresql96-server-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libecpg6-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libpq5-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libpq5-32bit-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 postgresql96-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 postgresql96-contrib-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 postgresql96-docs-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 postgresql96-server-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 postgresql96-devel-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 postgresql96-devel-9.6.7-3.13.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file. CVE-2018-1053 SUSE Linux Enterprise Desktop 12 SP2:libecpg6-9.6.7-3.13.1 SUSE Linux Enterprise Desktop 12 SP2:libpq5-32bit-9.6.7-3.13.1 SUSE Linux Enterprise Desktop 12 SP2:libpq5-9.6.7-3.13.1 SUSE Linux Enterprise Desktop 12 SP2:postgresql96-9.6.7-3.13.1 SUSE Linux Enterprise Desktop 12 SP3:libecpg6-9.6.7-3.13.1 SUSE Linux Enterprise Desktop 12 SP3:libpq5-32bit-9.6.7-3.13.1 SUSE Linux Enterprise Desktop 12 SP3:libpq5-9.6.7-3.13.1 SUSE Linux Enterprise Desktop 12 SP3:postgresql96-9.6.7-3.13.1 SUSE Linux Enterprise Server 12 SP2:libecpg6-9.6.7-3.13.1 SUSE Linux Enterprise Server 12 SP2:libpq5-32bit-9.6.7-3.13.1 SUSE Linux Enterprise Server 12 SP2:libpq5-9.6.7-3.13.1 SUSE Linux Enterprise Server 12 SP2:postgresql96-9.6.7-3.13.1 SUSE Linux Enterprise Server 12 SP2:postgresql96-contrib-9.6.7-3.13.1 SUSE Linux Enterprise Server 12 SP2:postgresql96-docs-9.6.7-3.13.1 SUSE Linux Enterprise Server 12 SP2:postgresql96-server-9.6.7-3.13.1 SUSE Linux Enterprise Server 12 SP3:libecpg6-9.6.7-3.13.1 SUSE Linux Enterprise Server 12 SP3:libpq5-32bit-9.6.7-3.13.1 SUSE Linux Enterprise Server 12 SP3:libpq5-9.6.7-3.13.1 SUSE Linux Enterprise Server 12 SP3:postgresql96-9.6.7-3.13.1 SUSE Linux Enterprise Server 12 SP3:postgresql96-contrib-9.6.7-3.13.1 SUSE Linux Enterprise Server 12 SP3:postgresql96-docs-9.6.7-3.13.1 SUSE Linux Enterprise Server 12 SP3:postgresql96-server-9.6.7-3.13.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libecpg6-9.6.7-3.13.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libpq5-9.6.7-3.13.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql96-9.6.7-3.13.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql96-contrib-9.6.7-3.13.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql96-docs-9.6.7-3.13.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:postgresql96-server-9.6.7-3.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libecpg6-9.6.7-3.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libpq5-32bit-9.6.7-3.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libpq5-9.6.7-3.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql96-9.6.7-3.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql96-contrib-9.6.7-3.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql96-docs-9.6.7-3.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:postgresql96-server-9.6.7-3.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libecpg6-9.6.7-3.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libpq5-32bit-9.6.7-3.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libpq5-9.6.7-3.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:postgresql96-9.6.7-3.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:postgresql96-contrib-9.6.7-3.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:postgresql96-docs-9.6.7-3.13.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:postgresql96-server-9.6.7-3.13.1 SUSE Linux Enterprise Software Development Kit 12 SP2:postgresql96-devel-9.6.7-3.13.1 SUSE Linux Enterprise Software Development Kit 12 SP3:postgresql96-devel-9.6.7-3.13.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180507-1/ https://www.suse.com/security/cve/CVE-2018-1053.html CVE-2018-1053 https://bugzilla.suse.com/1077983 SUSE Bug 1077983 https://bugzilla.suse.com/1185814 SUSE Bug 1185814