Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-FU-2022:2794-1

Опубликовано: 12 авг. 2022
Источник: suse-cvrf

Описание

Feature update for ongres-scram, ongres-stringprep, postgresql-jdbc

This feature update for ongres-scram, ongres-stringprep, postgresql-jdbc provides:

ongres-scram:

  • Upgrade from version 1.0.0-beta.2 to version 2.1. (jsc#SLE-23994)
    • Add standard SASLPrep (bsc#1196693, jsc#SLE-23994)
    • Failover to bouncy castle implementation of PBKDF2WithHmacSHA256 to support Oracle JDK 7
    • Updated saslprep to version 1.1 to remove a build dependency coming from the stringprep module

ongres-stringprep:

  • Introduce ongres-stringprep 1.1 as dependency of ongres-scram. (bsc#1196693, jsc#SLE-23994)

postgresql-jdbc:

  • CVE-2022-26520: Fixed arbitrary File Write Vulnerability (bsc#1197356)
  • Upgrade postgresql-jdbc from version 42.2.16 to version 42.2.25 (jsc#SLE-23994)
    • Use SASLprep normalization for SCRAM authentication and fixes issues with spaces in passwords. (bsc#1196693)

Список пакетов

Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure
ongres-scram-2.1-150300.3.3.4
ongres-scram-client-2.1-150300.3.3.4
ongres-stringprep-1.1-150300.7.3.4
ongres-stringprep-saslprep-1.1-150300.7.3.4
postgresql-jdbc-42.2.25-150300.3.5.2
Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM
ongres-scram-2.1-150300.3.3.4
ongres-scram-client-2.1-150300.3.3.4
ongres-stringprep-1.1-150300.7.3.4
ongres-stringprep-saslprep-1.1-150300.7.3.4
postgresql-jdbc-42.2.25-150300.3.5.2
Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE
ongres-scram-2.1-150300.3.3.4
ongres-scram-client-2.1-150300.3.3.4
ongres-stringprep-1.1-150300.7.3.4
ongres-stringprep-saslprep-1.1-150300.7.3.4
postgresql-jdbc-42.2.25-150300.3.5.2
SUSE Linux Enterprise Module for Server Applications 15 SP3
ongres-scram-2.1-150300.3.3.4
ongres-scram-client-2.1-150300.3.3.4
ongres-stringprep-1.1-150300.7.3.4
ongres-stringprep-saslprep-1.1-150300.7.3.4
postgresql-jdbc-42.2.25-150300.3.5.2
SUSE Manager Server Module 4.2
ongres-scram-2.1-150300.3.3.4
ongres-scram-client-2.1-150300.3.3.4
ongres-stringprep-1.1-150300.7.3.4
ongres-stringprep-saslprep-1.1-150300.7.3.4
postgresql-jdbc-42.2.25-150300.3.5.2
openSUSE Leap 15.3
ongres-scram-2.1-150300.3.3.4
ongres-scram-client-2.1-150300.3.3.4
ongres-scram-javadoc-2.1-150300.3.3.4
ongres-scram-parent-2.1-150300.3.3.4
ongres-stringprep-1.1-150300.7.3.4
ongres-stringprep-codegenerator-1.1-150300.7.3.4
ongres-stringprep-javadoc-1.1-150300.7.3.4
ongres-stringprep-parent-1.1-150300.7.3.4
ongres-stringprep-saslprep-1.1-150300.7.3.4
postgresql-jdbc-42.2.25-150300.3.5.2
postgresql-jdbc-javadoc-42.2.25-150300.3.5.2

Ссылки

Описание

** DISPUTED ** In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties.

Затронутые продукты
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:ongres-scram-2.1-150300.3.3.4
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:ongres-scram-client-2.1-150300.3.3.4
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:ongres-stringprep-1.1-150300.7.3.4
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:ongres-stringprep-saslprep-1.1-150300.7.3.4
Ссылки