SUSE-SU-2024:4176-1

HIGH8.8

Security update for postgresql14

Published Dec 4, 2024

Modified 1 years ago

Fix available

Details

Description of the patch:

This update for postgresql14 fixes the following issues:

CVE-2024-10976: Ensure cached plans are marked as dependent on the calling role when RLS applies to a non-top-level table reference (bsc#1233323).
CVE-2024-10977: Make libpq discard error messages received during SSL or GSS protocol negotiation (bsc#1233325).
CVE-2024-10978: Fix unintended interactions between SET SESSION AUTHORIZATION and SET ROLE (bsc#1233326).
CVE-2024-10979: Prevent trusted PL/Perl code from changing environment variables (bsc#1233327).

Affected Packages(12 packages)

postgresql14

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

14.15-150200.5.50.1

postgresql14-contrib

Fixed in:

14.15-150200.5.50.1

postgresql14-devel

Fixed in:

14.15-150200.5.50.1

postgresql14-docs

Fixed in:

14.15-150200.5.50.1

postgresql14-plperl

Fixed in:

14.15-150200.5.50.1

postgresql14-plpython

Fixed in:

14.15-150200.5.50.1

postgresql14-pltcl

Fixed in:

14.15-150200.5.50.1

postgresql14-server

Fixed in:

14.15-150200.5.50.1

postgresql14-server-devel

Fixed in:

14.15-150200.5.50.1

postgresql14-llvmjit

SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise Module for Legacy 15 SP5SUSE Linux Enterprise Module for Package Hub 15 SP5SUSE Linux Enterprise Server 15 SP5SUSE Linux Enterprise Server for SAP Applications 15 SP5

Fixed in:

14.15-150200.5.50.1

References

ADVISORY

https://bugzilla.suse.com/1233323

ADVISORY

https://bugzilla.suse.com/1233325

ADVISORY

https://bugzilla.suse.com/1233326

ADVISORY

https://bugzilla.suse.com/1233327

ADVISORY