| Summary: | postgresql new security issues CVE-2020-2569[4-6] | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | andrewsfarm, herman.viaene, joequant, joequant, nicolas.salguero, ouaurelien, sysadmin-bugs |
| Version: | 7 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA7-64-OK | ||
| Source RPM: | postgresql11-11.9-1.mga7.src.rpm, postgresql9.6-9.6.19-1.mga7.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2020-11-14 23:02:01 CET
David Walser
2020-11-14 23:02:16 CET
Whiteboard:
(none) =>
MGA7TOO Difficult to assign this: to Marc for 9.6 (M7) & 11 (M7 & M8), Nicolas for all 3. CC'ing Joseph for 9.6 & 12 (M8) if he is still with us. Assignee:
bugsquad =>
mageia I was just helping while Joseph was not avail. If Nico did the last releases, feel free to do this too. Submitting new rpm for postgres12 Built version 12.5 postgresql Suggested advisory: ======================== The updated packages fix security vulnerabilities: A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25694) A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695) psql's \gset allows overwriting specially treated variables. (CVE-2020-25696) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25694 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25695 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25696 https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/ ======================== Updated packages in core/updates_testing: ======================== postgresql9.6-9.6.20-1.mga7 lib(64)pq5.9-9.6.20-1.mga7 lib(64)ecpg9.6_6-9.6.20-1.mga7 postgresql9.6-server-9.6.20-1.mga7 postgresql9.6-docs-9.6.20-1.mga7 postgresql9.6-contrib-9.6.20-1.mga7 postgresql9.6-devel-9.6.20-1.mga7 postgresql9.6-pl-9.6.20-1.mga7 postgresql9.6-plpython-9.6.20-1.mga7 postgresql9.6-plperl-9.6.20-1.mga7 postgresql9.6-pltcl-9.6.20-1.mga7 postgresql9.6-plpgsql-9.6.20-1.mga7 postgresql11-11.10-1.mga7 lib(64)pq5-11.10-1.mga7 lib(64)ecpg11_6-11.10-1.mga7 postgresql11-server-11.10-1.mga7 postgresql11-docs-11.10-1.mga7 postgresql11-contrib-11.10-1.mga7 postgresql11-devel-11.10-1.mga7 postgresql11-pl-11.10-1.mga7 postgresql11-plpython-11.10-1.mga7 postgresql11-plpython3-11.10-1.mga7 postgresql11-plperl-11.10-1.mga7 postgresql11-pltcl-11.10-1.mga7 postgresql11-plpgsql-11.10-1.mga7 from SRPMS: postgresql9.6-9.6.20-1.mga7.src.rpm postgresql11-11.10-1.mga7.src.rpm Assignee:
mageia =>
qa-bugs MGA7_64 MATE on Peaq C1011 No installation issues. First installed the 9.6, used pgadmin3 and phpPgAdmin to create a new schema, new role, new table in that schema and owned by this role. Defined columns in the table, a primary and a unique key, and inserted a few rows. Works OK. Then installed the 11 version which ousted the 9.6 packages, startted the service again. Opened the test database first created, all was there, then created a second table using the "create like" option and added a row. All OK, good to go. CC:
(none) =>
herman.viaene Validating. Advisory in Comment 6. CC:
(none) =>
andrewsfarm, sysadmin-bugs Advisory pushed to SVN. Keywords:
(none) =>
advisory An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2020-0432.html Resolution:
(none) =>
FIXED |