Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2018:3770-1

Опубликовано: 15 нояб. 2018
Источник: suse-cvrf

Описание

Security update for postgresql10

This update for postgresql10 fixes the following issues:

Security issue fixed:

  • CVE-2018-16850: Fixed improper quoting of transition table names when pg_dump emits CREATE TRIGGER could have caused privilege escalation (bsc#1114837).

Non-security issues fixed:

Список пакетов

SUSE Linux Enterprise Desktop 12 SP3
libecpg6-10.6-1.6.1
libpq5-10.6-1.6.1
libpq5-32bit-10.6-1.6.1
postgresql10-10.6-1.6.1
SUSE Linux Enterprise Server 12 SP3
libecpg6-10.6-1.6.1
libpq5-10.6-1.6.1
libpq5-32bit-10.6-1.6.1
postgresql10-10.6-1.6.1
postgresql10-contrib-10.6-1.6.1
postgresql10-docs-10.6-1.6.1
postgresql10-server-10.6-1.6.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
libecpg6-10.6-1.6.1
libpq5-10.6-1.6.1
libpq5-32bit-10.6-1.6.1
postgresql10-10.6-1.6.1
postgresql10-contrib-10.6-1.6.1
postgresql10-docs-10.6-1.6.1
postgresql10-server-10.6-1.6.1
SUSE Linux Enterprise Software Development Kit 12 SP3
postgresql10-devel-10.6-1.6.1

Ссылки

Описание

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP3:libecpg6-10.6-1.6.1
SUSE Linux Enterprise Desktop 12 SP3:libpq5-10.6-1.6.1
SUSE Linux Enterprise Desktop 12 SP3:libpq5-32bit-10.6-1.6.1
SUSE Linux Enterprise Desktop 12 SP3:postgresql10-10.6-1.6.1
Ссылки