Security update for postgresql15 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3342-1 Final 1 1 2023-08-17T11:57:02Z current 2023-08-17T11:57:02Z 2023-08-17T11:57:02Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postgresql15 This update for postgresql15 fixes the following issues: - Update to 15.4 - CVE-2023-39417: Fixed potential SQL injection for trusted extensions. (bsc#1214059) - CVE-2023-39418: Fix MERGE to enforce row security. (bsc#1214061) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-3342,SUSE-SLE-SDK-12-SP5-2023-3342,SUSE-SLE-SERVER-12-SP5-2023-3342 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233342-1/ Link for SUSE-SU-2023:3342-1 https://lists.suse.com/pipermail/sle-security-updates/2023-August/015941.html E-Mail link for SUSE-SU-2023:3342-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1214059 SUSE Bug 1214059 https://bugzilla.suse.com/1214061 SUSE Bug 1214061 https://www.suse.com/security/cve/CVE-2023-39417/ SUSE CVE CVE-2023-39417 page https://www.suse.com/security/cve/CVE-2023-39418/ SUSE CVE CVE-2023-39418 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 libecpg6-15.4-3.12.1 libecpg6-32bit-15.4-3.12.1 libecpg6-64bit-15.4-3.12.1 libpq5-15.4-3.12.1 libpq5-32bit-15.4-3.12.1 libpq5-64bit-15.4-3.12.1 postgresql15-15.4-3.12.1 postgresql15-contrib-15.4-3.12.1 postgresql15-devel-15.4-3.12.1 postgresql15-devel-mini-15.4-3.12.1 postgresql15-docs-15.4-3.12.1 postgresql15-llvmjit-devel-15.4-3.12.1 postgresql15-plperl-15.4-3.12.1 postgresql15-plpython-15.4-3.12.1 postgresql15-pltcl-15.4-3.12.1 postgresql15-server-15.4-3.12.1 postgresql15-server-devel-15.4-3.12.1 postgresql15-test-15.4-3.12.1 libecpg6-15.4-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP5 libecpg6-32bit-15.4-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP5 libpq5-15.4-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP5 libpq5-32bit-15.4-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP5 postgresql15-15.4-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP5 postgresql15-contrib-15.4-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP5 postgresql15-docs-15.4-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP5 postgresql15-plperl-15.4-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP5 postgresql15-plpython-15.4-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP5 postgresql15-pltcl-15.4-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP5 postgresql15-server-15.4-3.12.1 as a component of SUSE Linux Enterprise Server 12 SP5 libecpg6-15.4-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libecpg6-32bit-15.4-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libpq5-15.4-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libpq5-32bit-15.4-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 postgresql15-15.4-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 postgresql15-contrib-15.4-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 postgresql15-docs-15.4-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 postgresql15-plperl-15.4-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 postgresql15-plpython-15.4-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 postgresql15-pltcl-15.4-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 postgresql15-server-15.4-3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 postgresql15-devel-15.4-3.12.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 postgresql15-server-devel-15.4-3.12.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. CVE-2023-39417 SUSE Linux Enterprise Server 12 SP5:libecpg6-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:libecpg6-32bit-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:libpq5-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:libpq5-32bit-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:postgresql15-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:postgresql15-contrib-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:postgresql15-docs-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:postgresql15-plperl-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:postgresql15-plpython-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:postgresql15-pltcl-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:postgresql15-server-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libecpg6-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libecpg6-32bit-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpq5-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpq5-32bit-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postgresql15-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postgresql15-contrib-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postgresql15-docs-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postgresql15-plperl-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postgresql15-plpython-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postgresql15-pltcl-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postgresql15-server-15.4-3.12.1 SUSE Linux Enterprise Software Development Kit 12 SP5:postgresql15-devel-15.4-3.12.1 SUSE Linux Enterprise Software Development Kit 12 SP5:postgresql15-server-devel-15.4-3.12.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233342-1/ https://www.suse.com/security/cve/CVE-2023-39417.html CVE-2023-39417 https://bugzilla.suse.com/1214059 SUSE Bug 1214059 A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows. CVE-2023-39418 SUSE Linux Enterprise Server 12 SP5:libecpg6-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:libecpg6-32bit-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:libpq5-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:libpq5-32bit-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:postgresql15-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:postgresql15-contrib-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:postgresql15-docs-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:postgresql15-plperl-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:postgresql15-plpython-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:postgresql15-pltcl-15.4-3.12.1 SUSE Linux Enterprise Server 12 SP5:postgresql15-server-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libecpg6-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libecpg6-32bit-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpq5-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpq5-32bit-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postgresql15-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postgresql15-contrib-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postgresql15-docs-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postgresql15-plperl-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postgresql15-plpython-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postgresql15-pltcl-15.4-3.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:postgresql15-server-15.4-3.12.1 SUSE Linux Enterprise Software Development Kit 12 SP5:postgresql15-devel-15.4-3.12.1 SUSE Linux Enterprise Software Development Kit 12 SP5:postgresql15-server-devel-15.4-3.12.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233342-1/ https://www.suse.com/security/cve/CVE-2023-39418.html CVE-2023-39418 https://bugzilla.suse.com/1214061 SUSE Bug 1214061