Security update for postgresql10 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0589-1 Final 1 1 2020-03-05T09:33:42Z current 2020-03-05T09:33:42Z 2020-03-05T09:33:42Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postgresql10 This update for postgresql10 fixes the following issues: PostgreSQL was updated to version 10.12. Security issue fixed: - CVE-2020-1720: Fixed a missing authorization check in the ALTER ... DEPENDS ON extension (bsc#1163985). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-589,SUSE-SLE-Module-Basesystem-15-2020-589,SUSE-SLE-Module-Development-Tools-OBS-15-2020-589,SUSE-SLE-Module-Packagehub-Subpackages-15-2020-589,SUSE-SLE-Module-Server-Applications-15-2020-589,SUSE-SLE-Product-HPC-15-2020-589,SUSE-SLE-Product-SLES-15-2020-589,SUSE-SLE-Product-SLES_SAP-15-2020-589 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200589-1/ Link for SUSE-SU-2020:0589-1 https://lists.suse.com/pipermail/sle-security-updates/2020-March/006578.html E-Mail link for SUSE-SU-2020:0589-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1163985 SUSE Bug 1163985 https://www.suse.com/security/cve/CVE-2020-1720/ SUSE CVE CVE-2020-1720 page SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Package Hub 15 SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 libecpg6-10.12-4.19.1 libecpg6-32bit-10.12-4.19.1 libecpg6-64bit-10.12-4.19.1 libpq5-10.12-4.19.1 libpq5-32bit-10.12-4.19.1 libpq5-64bit-10.12-4.19.1 postgresql10-10.12-4.19.1 postgresql10-contrib-10.12-4.19.1 postgresql10-devel-10.12-4.19.1 postgresql10-docs-10.12-4.19.1 postgresql10-plperl-10.12-4.19.1 postgresql10-plpython-10.12-4.19.1 postgresql10-pltcl-10.12-4.19.1 postgresql10-server-10.12-4.19.1 postgresql10-test-10.12-4.19.1 libecpg6-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libpq5-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS postgresql10-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS postgresql10-contrib-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS postgresql10-devel-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS postgresql10-docs-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS postgresql10-plperl-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS postgresql10-plpython-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS postgresql10-pltcl-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS postgresql10-server-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libecpg6-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libpq5-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS postgresql10-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS postgresql10-contrib-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS postgresql10-devel-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS postgresql10-docs-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS postgresql10-plperl-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS postgresql10-plpython-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS postgresql10-pltcl-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS postgresql10-server-10.12-4.19.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libpq5-10.12-4.19.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 postgresql10-10.12-4.19.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 postgresql10-test-10.12-4.19.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 libecpg6-10.12-4.19.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 postgresql10-contrib-10.12-4.19.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 postgresql10-devel-10.12-4.19.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 postgresql10-docs-10.12-4.19.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 postgresql10-plperl-10.12-4.19.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 postgresql10-plpython-10.12-4.19.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 postgresql10-pltcl-10.12-4.19.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 postgresql10-server-10.12-4.19.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 libecpg6-10.12-4.19.1 as a component of SUSE Linux Enterprise Server 15-LTSS libpq5-10.12-4.19.1 as a component of SUSE Linux Enterprise Server 15-LTSS postgresql10-10.12-4.19.1 as a component of SUSE Linux Enterprise Server 15-LTSS postgresql10-contrib-10.12-4.19.1 as a component of SUSE Linux Enterprise Server 15-LTSS postgresql10-devel-10.12-4.19.1 as a component of SUSE Linux Enterprise Server 15-LTSS postgresql10-docs-10.12-4.19.1 as a component of SUSE Linux Enterprise Server 15-LTSS postgresql10-plperl-10.12-4.19.1 as a component of SUSE Linux Enterprise Server 15-LTSS postgresql10-plpython-10.12-4.19.1 as a component of SUSE Linux Enterprise Server 15-LTSS postgresql10-pltcl-10.12-4.19.1 as a component of SUSE Linux Enterprise Server 15-LTSS postgresql10-server-10.12-4.19.1 as a component of SUSE Linux Enterprise Server 15-LTSS libecpg6-10.12-4.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libpq5-10.12-4.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 postgresql10-10.12-4.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 postgresql10-contrib-10.12-4.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 postgresql10-devel-10.12-4.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 postgresql10-docs-10.12-4.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 postgresql10-plperl-10.12-4.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 postgresql10-plpython-10.12-4.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 postgresql10-pltcl-10.12-4.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 postgresql10-server-10.12-4.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17. CVE-2020-1720 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libecpg6-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libpq5-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:postgresql10-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:postgresql10-contrib-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:postgresql10-devel-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:postgresql10-docs-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:postgresql10-plperl-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:postgresql10-plpython-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:postgresql10-pltcl-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:postgresql10-server-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libecpg6-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libpq5-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:postgresql10-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:postgresql10-contrib-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:postgresql10-devel-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:postgresql10-docs-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:postgresql10-plperl-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:postgresql10-plpython-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:postgresql10-pltcl-10.12-4.19.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:postgresql10-server-10.12-4.19.1 SUSE Linux Enterprise Module for Basesystem 15:libpq5-10.12-4.19.1 SUSE Linux Enterprise Module for Basesystem 15:postgresql10-10.12-4.19.1 SUSE Linux Enterprise Module for Package Hub 15:postgresql10-test-10.12-4.19.1 SUSE Linux Enterprise Module for Server Applications 15:libecpg6-10.12-4.19.1 SUSE Linux Enterprise Module for Server Applications 15:postgresql10-contrib-10.12-4.19.1 SUSE Linux Enterprise Module for Server Applications 15:postgresql10-devel-10.12-4.19.1 SUSE Linux Enterprise Module for Server Applications 15:postgresql10-docs-10.12-4.19.1 SUSE Linux Enterprise Module for Server Applications 15:postgresql10-plperl-10.12-4.19.1 SUSE Linux Enterprise Module for Server Applications 15:postgresql10-plpython-10.12-4.19.1 SUSE Linux Enterprise Module for Server Applications 15:postgresql10-pltcl-10.12-4.19.1 SUSE Linux Enterprise Module for Server Applications 15:postgresql10-server-10.12-4.19.1 SUSE Linux Enterprise Server 15-LTSS:libecpg6-10.12-4.19.1 SUSE Linux Enterprise Server 15-LTSS:libpq5-10.12-4.19.1 SUSE Linux Enterprise Server 15-LTSS:postgresql10-10.12-4.19.1 SUSE Linux Enterprise Server 15-LTSS:postgresql10-contrib-10.12-4.19.1 SUSE Linux Enterprise Server 15-LTSS:postgresql10-devel-10.12-4.19.1 SUSE Linux Enterprise Server 15-LTSS:postgresql10-docs-10.12-4.19.1 SUSE Linux Enterprise Server 15-LTSS:postgresql10-plperl-10.12-4.19.1 SUSE Linux Enterprise Server 15-LTSS:postgresql10-plpython-10.12-4.19.1 SUSE Linux Enterprise Server 15-LTSS:postgresql10-pltcl-10.12-4.19.1 SUSE Linux Enterprise Server 15-LTSS:postgresql10-server-10.12-4.19.1 SUSE Linux Enterprise Server for SAP Applications 15:libecpg6-10.12-4.19.1 SUSE Linux Enterprise Server for SAP Applications 15:libpq5-10.12-4.19.1 SUSE Linux Enterprise Server for SAP Applications 15:postgresql10-10.12-4.19.1 SUSE Linux Enterprise Server for SAP Applications 15:postgresql10-contrib-10.12-4.19.1 SUSE Linux Enterprise Server for SAP Applications 15:postgresql10-devel-10.12-4.19.1 SUSE Linux Enterprise Server for SAP Applications 15:postgresql10-docs-10.12-4.19.1 SUSE Linux Enterprise Server for SAP Applications 15:postgresql10-plperl-10.12-4.19.1 SUSE Linux Enterprise Server for SAP Applications 15:postgresql10-plpython-10.12-4.19.1 SUSE Linux Enterprise Server for SAP Applications 15:postgresql10-pltcl-10.12-4.19.1 SUSE Linux Enterprise Server for SAP Applications 15:postgresql10-server-10.12-4.19.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200589-1/ https://www.suse.com/security/cve/CVE-2020-1720.html CVE-2020-1720 https://bugzilla.suse.com/1163985 SUSE Bug 1163985