SUSE-SU-2020:0589-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2020:0589-1

MEDIUM4.2

Security update for postgresql10

Published Mar 5, 2020

Modified 6 years ago

Fix available

Details

Description of the patch:

This update for postgresql10 fixes the following issues:

PostgreSQL was updated to version 10.12.

Security issue fixed:

CVE-2020-1720: Fixed a missing authorization check in the ALTER ... DEPENDS ON extension (bsc#1163985).

Affected Packages(11 packages)

libecpg6

SUSE Linux Enterprise High Performance Computing 15-ESPOSSUSE Linux Enterprise High Performance Computing 15-LTSSSUSE Linux Enterprise Module for Server Applications 15SUSE Linux Enterprise Server 15-LTSSSUSE Linux Enterprise Server for SAP Applications 15

Fixed in:

10.12-4.19.1

libpq5

SUSE Linux Enterprise High Performance Computing 15-ESPOSSUSE Linux Enterprise High Performance Computing 15-LTSSSUSE Linux Enterprise Module for Basesystem 15SUSE Linux Enterprise Server 15-LTSSSUSE Linux Enterprise Server for SAP Applications 15

Fixed in:

10.12-4.19.1

postgresql10

SUSE Linux Enterprise High Performance Computing 15-ESPOSSUSE Linux Enterprise High Performance Computing 15-LTSSSUSE Linux Enterprise Module for Basesystem 15SUSE Linux Enterprise Server 15-LTSSSUSE Linux Enterprise Server for SAP Applications 15

Fixed in:

10.12-4.19.1

postgresql10-contrib

SUSE Linux Enterprise High Performance Computing 15-ESPOSSUSE Linux Enterprise High Performance Computing 15-LTSSSUSE Linux Enterprise Module for Server Applications 15SUSE Linux Enterprise Server 15-LTSSSUSE Linux Enterprise Server for SAP Applications 15

Fixed in:

10.12-4.19.1

postgresql10-devel

SUSE Linux Enterprise High Performance Computing 15-ESPOSSUSE Linux Enterprise High Performance Computing 15-LTSSSUSE Linux Enterprise Module for Server Applications 15SUSE Linux Enterprise Server 15-LTSSSUSE Linux Enterprise Server for SAP Applications 15

Fixed in:

10.12-4.19.1

postgresql10-docs

SUSE Linux Enterprise High Performance Computing 15-ESPOSSUSE Linux Enterprise High Performance Computing 15-LTSSSUSE Linux Enterprise Module for Server Applications 15SUSE Linux Enterprise Server 15-LTSSSUSE Linux Enterprise Server for SAP Applications 15

Fixed in:

10.12-4.19.1

postgresql10-plperl

SUSE Linux Enterprise High Performance Computing 15-ESPOSSUSE Linux Enterprise High Performance Computing 15-LTSSSUSE Linux Enterprise Module for Server Applications 15SUSE Linux Enterprise Server 15-LTSSSUSE Linux Enterprise Server for SAP Applications 15

Fixed in:

10.12-4.19.1

postgresql10-plpython

SUSE Linux Enterprise High Performance Computing 15-ESPOSSUSE Linux Enterprise High Performance Computing 15-LTSSSUSE Linux Enterprise Module for Server Applications 15SUSE Linux Enterprise Server 15-LTSSSUSE Linux Enterprise Server for SAP Applications 15

Fixed in:

10.12-4.19.1

postgresql10-pltcl

SUSE Linux Enterprise High Performance Computing 15-ESPOSSUSE Linux Enterprise High Performance Computing 15-LTSSSUSE Linux Enterprise Module for Server Applications 15SUSE Linux Enterprise Server 15-LTSSSUSE Linux Enterprise Server for SAP Applications 15

Fixed in:

10.12-4.19.1

postgresql10-server

SUSE Linux Enterprise High Performance Computing 15-ESPOSSUSE Linux Enterprise High Performance Computing 15-LTSSSUSE Linux Enterprise Module for Server Applications 15SUSE Linux Enterprise Server 15-LTSSSUSE Linux Enterprise Server for SAP Applications 15

Fixed in:

10.12-4.19.1

References

https://bugzilla.suse.com/1163985

https://lists.suse.com/pipermail/sle-security-updates/2020-March/006578.html

https://www.suse.com/security/cve/CVE-2020-1720/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2020/suse-su-20200589-1/

CVSS Analysis

CVSS v3.1

4.2

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

LowI:L

Availability

LowA:L

4.2/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Upstream

Ecosystems(7)

SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Package Hub 15 SUSE Linux Enterprise Module for Server Applications 15

Timeline

PublishedMar 5, 2020

ModifiedMar 5, 2020