SUSE-SU-2024:4175-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2024:4175-1

HIGH8.8

Security update for postgresql13

Published Dec 4, 2024

Modified 1 years ago

Fix available

Details

Description of the patch:

This update for postgresql13 fixes the following issues:

CVE-2024-10976: Ensure cached plans are marked as dependent on the calling role when RLS applies to a non-top-level table reference (bsc#1233323).
CVE-2024-10977: Make libpq discard error messages received during SSL or GSS protocol negotiation (bsc#1233325).
CVE-2024-10978: Fix unintended interactions between SET SESSION AUTHORIZATION and SET ROLE (bsc#1233326).
CVE-2024-10979: Prevent trusted PL/Perl code from changing environment variables (bsc#1233327).

Affected Packages(12 packages)

postgresql13

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

13.18-150200.5.64.1

postgresql13-contrib

Fixed in:

13.18-150200.5.64.1

postgresql13-devel

Fixed in:

13.18-150200.5.64.1

postgresql13-docs

Fixed in:

13.18-150200.5.64.1

postgresql13-plperl

Fixed in:

13.18-150200.5.64.1

postgresql13-plpython

Fixed in:

13.18-150200.5.64.1

postgresql13-pltcl

Fixed in:

13.18-150200.5.64.1

postgresql13-server

Fixed in:

13.18-150200.5.64.1

postgresql13-server-devel

Fixed in:

13.18-150200.5.64.1

postgresql13-llvmjit

SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise Server 15 SP4SUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

13.18-150200.5.64.1

References

ADVISORY

https://bugzilla.suse.com/1233323

ADVISORY

https://bugzilla.suse.com/1233325

ADVISORY

https://bugzilla.suse.com/1233326

ADVISORY

https://bugzilla.suse.com/1233327

ADVISORY