Security update for postgresql10 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0752-1 Final 1 1 2020-03-23T15:33:12Z current 2020-03-23T15:33:12Z 2020-03-23T15:33:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postgresql10 This update for postgresql10 fixes the following issues: PostgreSQL was updated to version 10.12. Security issue fixed: - CVE-2020-1720: Fixed a missing authorization check in the ALTER ... DEPENDS ON extension (bsc#1163985). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/postgres:10-2020-752,Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server-2020-752,Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server-2020-752,Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server-2020-752,SUSE-2020-752,SUSE-SLE-Module-Basesystem-15-SP1-2020-752,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-752,SUSE-SLE-Module-Server-Applications-15-SP1-2020-752 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200752-1/ Link for SUSE-SU-2020:0752-1 https://lists.suse.com/pipermail/sle-security-updates/2020-March/006633.html E-Mail link for SUSE-SU-2020:0752-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1163985 SUSE Bug 1163985 https://www.suse.com/security/cve/CVE-2020-1720/ SUSE CVE CVE-2020-1720 page Container suse/postgres:10 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 postgresql10-10.12-8.9.1 postgresql10-server-10.12-8.9.1 libpq5-10.12-8.9.1 postgresql10-contrib-10.12-8.9.1 libecpg6-10.12-8.9.1 libecpg6-32bit-10.12-8.9.1 libecpg6-64bit-10.12-8.9.1 libpq5-32bit-10.12-8.9.1 libpq5-64bit-10.12-8.9.1 postgresql10-devel-10.12-8.9.1 postgresql10-docs-10.12-8.9.1 postgresql10-plperl-10.12-8.9.1 postgresql10-plpython-10.12-8.9.1 postgresql10-pltcl-10.12-8.9.1 postgresql10-test-10.12-8.9.1 postgresql10-10.12-8.9.1 as a component of Container suse/postgres:10 postgresql10-server-10.12-8.9.1 as a component of Container suse/postgres:10 libpq5-10.12-8.9.1 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server postgresql10-10.12-8.9.1 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server postgresql10-contrib-10.12-8.9.1 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server postgresql10-server-10.12-8.9.1 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server libpq5-10.12-8.9.1 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server postgresql10-10.12-8.9.1 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server postgresql10-contrib-10.12-8.9.1 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server postgresql10-server-10.12-8.9.1 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server libpq5-10.12-8.9.1 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server postgresql10-10.12-8.9.1 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server postgresql10-contrib-10.12-8.9.1 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server postgresql10-server-10.12-8.9.1 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server libpq5-10.12-8.9.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 postgresql10-10.12-8.9.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 libecpg6-10.12-8.9.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 postgresql10-contrib-10.12-8.9.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 postgresql10-devel-10.12-8.9.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 postgresql10-docs-10.12-8.9.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 postgresql10-plperl-10.12-8.9.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 postgresql10-plpython-10.12-8.9.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 postgresql10-pltcl-10.12-8.9.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 postgresql10-server-10.12-8.9.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17. CVE-2020-1720 Container suse/postgres:10:postgresql10-10.12-8.9.1 Container suse/postgres:10:postgresql10-server-10.12-8.9.1 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:libpq5-10.12-8.9.1 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:postgresql10-10.12-8.9.1 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:postgresql10-contrib-10.12-8.9.1 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:postgresql10-server-10.12-8.9.1 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:libpq5-10.12-8.9.1 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:postgresql10-10.12-8.9.1 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:postgresql10-contrib-10.12-8.9.1 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:postgresql10-server-10.12-8.9.1 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:libpq5-10.12-8.9.1 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:postgresql10-10.12-8.9.1 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:postgresql10-contrib-10.12-8.9.1 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:postgresql10-server-10.12-8.9.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:libpq5-10.12-8.9.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:postgresql10-10.12-8.9.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:libecpg6-10.12-8.9.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:postgresql10-contrib-10.12-8.9.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:postgresql10-devel-10.12-8.9.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:postgresql10-docs-10.12-8.9.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:postgresql10-plperl-10.12-8.9.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:postgresql10-plpython-10.12-8.9.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:postgresql10-pltcl-10.12-8.9.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:postgresql10-server-10.12-8.9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200752-1/ https://www.suse.com/security/cve/CVE-2020-1720.html CVE-2020-1720 https://bugzilla.suse.com/1163985 SUSE Bug 1163985