Security update for postgresql10 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:1783-2 Final 1 1 2019-08-05T16:08:16Z current 2019-08-05T16:08:16Z 2019-08-05T16:08:16Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postgresql10 This update for postgresql10 to version 10.9 fixes the following issue: Security issue fixed: - CVE-2019-10164: Fixed buffer-overflow vulnerabilities in SCRAM verifier parsing (bsc#1138034). More information at https://www.postgresql.org/docs/10/release-10-9.html The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2019-1783,SUSE-2019-1783,SUSE-OpenStack-Cloud-Crowbar-8-2019-1783,SUSE-SLE-SERVER-12-SP3-2019-1783,SUSE-SLE-SERVER-12-SP3-BCL-2019-1783 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20191783-2/ Link for SUSE-SU-2019:1783-2 https://lists.suse.com/pipermail/sle-security-updates/2019-August/005776.html E-Mail link for SUSE-SU-2019:1783-2 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1138034 SUSE Bug 1138034 https://www.suse.com/security/cve/CVE-2019-10164/ SUSE CVE CVE-2019-10164 page HPE Helion OpenStack 8 SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP3-LTSS SUSE OpenStack Cloud Crowbar 8 libecpg6-10.9-1.12.1 libpq5-10.9-1.12.1 libpq5-32bit-10.9-1.12.1 postgresql10-10.9-1.12.2 postgresql10-contrib-10.9-1.12.2 postgresql10-docs-10.9-1.12.2 postgresql10-plperl-10.9-1.12.2 postgresql10-plpython-10.9-1.12.2 postgresql10-pltcl-10.9-1.12.2 postgresql10-server-10.9-1.12.2 libecpg6-32bit-10.9-1.12.1 libecpg6-64bit-10.9-1.12.1 libpq5-64bit-10.9-1.12.1 postgresql10-devel-10.9-1.12.1 postgresql10-test-10.9-1.12.2 libecpg6-10.9-1.12.1 as a component of HPE Helion OpenStack 8 libpq5-10.9-1.12.1 as a component of HPE Helion OpenStack 8 libpq5-32bit-10.9-1.12.1 as a component of HPE Helion OpenStack 8 postgresql10-10.9-1.12.2 as a component of HPE Helion OpenStack 8 postgresql10-contrib-10.9-1.12.2 as a component of HPE Helion OpenStack 8 postgresql10-docs-10.9-1.12.2 as a component of HPE Helion OpenStack 8 postgresql10-plperl-10.9-1.12.2 as a component of HPE Helion OpenStack 8 postgresql10-plpython-10.9-1.12.2 as a component of HPE Helion OpenStack 8 postgresql10-pltcl-10.9-1.12.2 as a component of HPE Helion OpenStack 8 postgresql10-server-10.9-1.12.2 as a component of HPE Helion OpenStack 8 libecpg6-10.9-1.12.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL libpq5-10.9-1.12.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL libpq5-32bit-10.9-1.12.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL postgresql10-10.9-1.12.2 as a component of SUSE Linux Enterprise Server 12 SP3-BCL postgresql10-contrib-10.9-1.12.2 as a component of SUSE Linux Enterprise Server 12 SP3-BCL postgresql10-docs-10.9-1.12.2 as a component of SUSE Linux Enterprise Server 12 SP3-BCL postgresql10-plperl-10.9-1.12.2 as a component of SUSE Linux Enterprise Server 12 SP3-BCL postgresql10-plpython-10.9-1.12.2 as a component of SUSE Linux Enterprise Server 12 SP3-BCL postgresql10-pltcl-10.9-1.12.2 as a component of SUSE Linux Enterprise Server 12 SP3-BCL postgresql10-server-10.9-1.12.2 as a component of SUSE Linux Enterprise Server 12 SP3-BCL libecpg6-10.9-1.12.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS libpq5-10.9-1.12.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS libpq5-32bit-10.9-1.12.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS postgresql10-10.9-1.12.2 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS postgresql10-contrib-10.9-1.12.2 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS postgresql10-docs-10.9-1.12.2 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS postgresql10-plperl-10.9-1.12.2 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS postgresql10-plpython-10.9-1.12.2 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS postgresql10-pltcl-10.9-1.12.2 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS postgresql10-server-10.9-1.12.2 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS libecpg6-10.9-1.12.1 as a component of SUSE OpenStack Cloud Crowbar 8 libpq5-10.9-1.12.1 as a component of SUSE OpenStack Cloud Crowbar 8 libpq5-32bit-10.9-1.12.1 as a component of SUSE OpenStack Cloud Crowbar 8 postgresql10-10.9-1.12.2 as a component of SUSE OpenStack Cloud Crowbar 8 postgresql10-contrib-10.9-1.12.2 as a component of SUSE OpenStack Cloud Crowbar 8 postgresql10-docs-10.9-1.12.2 as a component of SUSE OpenStack Cloud Crowbar 8 postgresql10-plperl-10.9-1.12.2 as a component of SUSE OpenStack Cloud Crowbar 8 postgresql10-plpython-10.9-1.12.2 as a component of SUSE OpenStack Cloud Crowbar 8 postgresql10-pltcl-10.9-1.12.2 as a component of SUSE OpenStack Cloud Crowbar 8 postgresql10-server-10.9-1.12.2 as a component of SUSE OpenStack Cloud Crowbar 8 PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account. CVE-2019-10164 HPE Helion OpenStack 8:libecpg6-10.9-1.12.1 HPE Helion OpenStack 8:libpq5-10.9-1.12.1 HPE Helion OpenStack 8:libpq5-32bit-10.9-1.12.1 HPE Helion OpenStack 8:postgresql10-10.9-1.12.2 HPE Helion OpenStack 8:postgresql10-contrib-10.9-1.12.2 HPE Helion OpenStack 8:postgresql10-docs-10.9-1.12.2 HPE Helion OpenStack 8:postgresql10-plperl-10.9-1.12.2 HPE Helion OpenStack 8:postgresql10-plpython-10.9-1.12.2 HPE Helion OpenStack 8:postgresql10-pltcl-10.9-1.12.2 HPE Helion OpenStack 8:postgresql10-server-10.9-1.12.2 SUSE Linux Enterprise Server 12 SP3-BCL:libecpg6-10.9-1.12.1 SUSE Linux Enterprise Server 12 SP3-BCL:libpq5-10.9-1.12.1 SUSE Linux Enterprise Server 12 SP3-BCL:libpq5-32bit-10.9-1.12.1 SUSE Linux Enterprise Server 12 SP3-BCL:postgresql10-10.9-1.12.2 SUSE Linux Enterprise Server 12 SP3-BCL:postgresql10-contrib-10.9-1.12.2 SUSE Linux Enterprise Server 12 SP3-BCL:postgresql10-docs-10.9-1.12.2 SUSE Linux Enterprise Server 12 SP3-BCL:postgresql10-plperl-10.9-1.12.2 SUSE Linux Enterprise Server 12 SP3-BCL:postgresql10-plpython-10.9-1.12.2 SUSE Linux Enterprise Server 12 SP3-BCL:postgresql10-pltcl-10.9-1.12.2 SUSE Linux Enterprise Server 12 SP3-BCL:postgresql10-server-10.9-1.12.2 SUSE Linux Enterprise Server 12 SP3-LTSS:libecpg6-10.9-1.12.1 SUSE Linux Enterprise Server 12 SP3-LTSS:libpq5-10.9-1.12.1 SUSE Linux Enterprise Server 12 SP3-LTSS:libpq5-32bit-10.9-1.12.1 SUSE Linux Enterprise Server 12 SP3-LTSS:postgresql10-10.9-1.12.2 SUSE Linux Enterprise Server 12 SP3-LTSS:postgresql10-contrib-10.9-1.12.2 SUSE Linux Enterprise Server 12 SP3-LTSS:postgresql10-docs-10.9-1.12.2 SUSE Linux Enterprise Server 12 SP3-LTSS:postgresql10-plperl-10.9-1.12.2 SUSE Linux Enterprise Server 12 SP3-LTSS:postgresql10-plpython-10.9-1.12.2 SUSE Linux Enterprise Server 12 SP3-LTSS:postgresql10-pltcl-10.9-1.12.2 SUSE Linux Enterprise Server 12 SP3-LTSS:postgresql10-server-10.9-1.12.2 SUSE OpenStack Cloud Crowbar 8:libecpg6-10.9-1.12.1 SUSE OpenStack Cloud Crowbar 8:libpq5-10.9-1.12.1 SUSE OpenStack Cloud Crowbar 8:libpq5-32bit-10.9-1.12.1 SUSE OpenStack Cloud Crowbar 8:postgresql10-10.9-1.12.2 SUSE OpenStack Cloud Crowbar 8:postgresql10-contrib-10.9-1.12.2 SUSE OpenStack Cloud Crowbar 8:postgresql10-docs-10.9-1.12.2 SUSE OpenStack Cloud Crowbar 8:postgresql10-plperl-10.9-1.12.2 SUSE OpenStack Cloud Crowbar 8:postgresql10-plpython-10.9-1.12.2 SUSE OpenStack Cloud Crowbar 8:postgresql10-pltcl-10.9-1.12.2 SUSE OpenStack Cloud Crowbar 8:postgresql10-server-10.9-1.12.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191783-2/ https://www.suse.com/security/cve/CVE-2019-10164.html CVE-2019-10164 https://bugzilla.suse.com/1138034 SUSE Bug 1138034