SUSE-SU-2024:4099-1

HIGH8.8

Security update for postgresql12

Published Nov 28, 2024

Modified 1 years ago

Fix available

Details

Description of the patch:

This update for postgresql12 fixes the following issues:

CVE-2024-10976: Ensure cached plans are marked as dependent on the calling role when RLS applies to a non-top-level table reference (bsc#1233323).
CVE-2024-10977: Make libpq discard error messages received during SSL or GSS protocol negotiation (bsc#1233325).
CVE-2024-10978: Fix unintended interactions between SET SESSION AUTHORIZATION and SET ROLE (bsc#1233326).
CVE-2024-10979: Prevent trusted PL/Perl code from changing environment variables (bsc#1233327).

Affected Packages(12 packages)

postgresql12

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

12.22-150200.8.66.1

postgresql12-contrib

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

12.22-150200.8.66.1

postgresql12-devel

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

12.22-150200.8.66.1

postgresql12-docs

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

12.22-150200.8.66.1

postgresql12-plperl

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

12.22-150200.8.66.1

postgresql12-plpython

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

12.22-150200.8.66.1

postgresql12-pltcl

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

12.22-150200.8.66.1

postgresql12-server

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

12.22-150200.8.66.1

postgresql12-server-devel

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

12.22-150200.8.66.1

postgresql12-llvmjit

openSUSE Leap 15.5openSUSE Leap 15.6

Fixed in:

12.22-150200.8.66.1

References

https://bugzilla.suse.com/1233323

https://bugzilla.suse.com/1233325

https://bugzilla.suse.com/1233326

https://bugzilla.suse.com/1233327

https://lists.suse.com/pipermail/sle-security-updates/2024-November/019868.html

https://www.suse.com/security/cve/CVE-2024-10976/

https://www.suse.com/security/cve/CVE-2024-10977/

https://www.suse.com/security/cve/CVE-2024-10978/

https://www.suse.com/security/cve/CVE-2024-10979/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2024/suse-su-20244099-1/

CVSS Analysis

CVSS v3.1

8.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

8.8/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Upstream

CVE-2024-10976 CVE-2024-10977 CVE-2024-10978 CVE-2024-10979

Ecosystems(13)

SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15 SP2 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Timeline

PublishedNov 28, 2024

ModifiedNov 28, 2024

SUSE-SU-2024:4099-1 | Mondoo Vulnerability Intelligence