Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2021:3755-1

Опубликовано: 20 нояб. 2021
Источник: suse-cvrf

Описание

Security update for postgresql, postgresql13, postgresql14

This update for postgresql, postgresql13 and postgresql14 fixes the following issues:

Security issues fixed:

  • CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
  • CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

This update also ships postgresql14 to SUSE Linux Enterprise 12 SP5. (jsc#SLE-22673) On older service packs only libpq5 and libecpg6 are being replaced by the postgresql14 variants.

Feature changes in postgresql14:

Список пакетов

HPE Helion OpenStack 8
libecpg6-14.1-3.3.1
libpq5-14.1-3.3.1
libpq5-32bit-14.1-3.3.1
postgresql-14-4.10.1
postgresql-contrib-14-4.10.1
postgresql-docs-14-4.10.1
postgresql-plperl-14-4.10.1
postgresql-plpython-14-4.10.1
postgresql-pltcl-14-4.10.1
postgresql-server-14-4.10.1
SUSE Linux Enterprise Server 12 SP2-BCL
libecpg6-14.1-3.3.1
libpq5-14.1-3.3.1
libpq5-32bit-14.1-3.3.1
postgresql-14-4.10.1
postgresql-contrib-14-4.10.1
postgresql-docs-14-4.10.1
postgresql-plperl-14-4.10.1
postgresql-plpython-14-4.10.1
postgresql-pltcl-14-4.10.1
postgresql-server-14-4.10.1
SUSE Linux Enterprise Server 12 SP3-BCL
libecpg6-14.1-3.3.1
libpq5-14.1-3.3.1
libpq5-32bit-14.1-3.3.1
postgresql-14-4.10.1
postgresql-contrib-14-4.10.1
postgresql-docs-14-4.10.1
postgresql-plperl-14-4.10.1
postgresql-plpython-14-4.10.1
postgresql-pltcl-14-4.10.1
postgresql-server-14-4.10.1
SUSE Linux Enterprise Server 12 SP3-LTSS
libecpg6-14.1-3.3.1
libpq5-14.1-3.3.1
libpq5-32bit-14.1-3.3.1
postgresql-14-4.10.1
postgresql-contrib-14-4.10.1
postgresql-docs-14-4.10.1
postgresql-plperl-14-4.10.1
postgresql-plpython-14-4.10.1
postgresql-pltcl-14-4.10.1
postgresql-server-14-4.10.1
SUSE Linux Enterprise Server 12 SP4-LTSS
libecpg6-14.1-3.3.1
libpq5-14.1-3.3.1
libpq5-32bit-14.1-3.3.1
postgresql-14-4.10.1
postgresql-contrib-14-4.10.1
postgresql-docs-14-4.10.1
postgresql-plperl-14-4.10.1
postgresql-plpython-14-4.10.1
postgresql-pltcl-14-4.10.1
postgresql-server-14-4.10.1
SUSE Linux Enterprise Server 12 SP5
libecpg6-14.1-3.3.1
libpq5-14.1-3.3.1
libpq5-32bit-14.1-3.3.1
postgresql-14-4.10.1
postgresql-contrib-14-4.10.1
postgresql-docs-14-4.10.1
postgresql-plperl-14-4.10.1
postgresql-plpython-14-4.10.1
postgresql-pltcl-14-4.10.1
postgresql-server-14-4.10.1
postgresql13-13.5-3.15.2
postgresql13-contrib-13.5-3.15.2
postgresql13-docs-13.5-3.15.2
postgresql13-plperl-13.5-3.15.2
postgresql13-plpython-13.5-3.15.2
postgresql13-pltcl-13.5-3.15.2
postgresql13-server-13.5-3.15.2
postgresql14-14.1-3.3.1
postgresql14-contrib-14.1-3.3.1
postgresql14-docs-14.1-3.3.1
postgresql14-plperl-14.1-3.3.1
postgresql14-plpython-14.1-3.3.1
postgresql14-pltcl-14.1-3.3.1
postgresql14-server-14.1-3.3.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
libecpg6-14.1-3.3.1
libpq5-14.1-3.3.1
libpq5-32bit-14.1-3.3.1
postgresql-14-4.10.1
postgresql-contrib-14-4.10.1
postgresql-docs-14-4.10.1
postgresql-plperl-14-4.10.1
postgresql-plpython-14-4.10.1
postgresql-pltcl-14-4.10.1
postgresql-server-14-4.10.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4
libecpg6-14.1-3.3.1
libpq5-14.1-3.3.1
libpq5-32bit-14.1-3.3.1
postgresql-14-4.10.1
postgresql-contrib-14-4.10.1
postgresql-docs-14-4.10.1
postgresql-plperl-14-4.10.1
postgresql-plpython-14-4.10.1
postgresql-pltcl-14-4.10.1
postgresql-server-14-4.10.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
libecpg6-14.1-3.3.1
libpq5-14.1-3.3.1
libpq5-32bit-14.1-3.3.1
postgresql-14-4.10.1
postgresql-contrib-14-4.10.1
postgresql-docs-14-4.10.1
postgresql-plperl-14-4.10.1
postgresql-plpython-14-4.10.1
postgresql-pltcl-14-4.10.1
postgresql-server-14-4.10.1
postgresql13-13.5-3.15.2
postgresql13-contrib-13.5-3.15.2
postgresql13-docs-13.5-3.15.2
postgresql13-plperl-13.5-3.15.2
postgresql13-plpython-13.5-3.15.2
postgresql13-pltcl-13.5-3.15.2
postgresql13-server-13.5-3.15.2
postgresql14-14.1-3.3.1
postgresql14-contrib-14.1-3.3.1
postgresql14-docs-14.1-3.3.1
postgresql14-plperl-14.1-3.3.1
postgresql14-plpython-14.1-3.3.1
postgresql14-pltcl-14.1-3.3.1
postgresql14-server-14.1-3.3.1
SUSE Linux Enterprise Software Development Kit 12 SP5
postgresql-devel-14-4.10.1
postgresql-server-devel-14-4.10.1
postgresql13-devel-13.5-3.15.2
postgresql13-server-devel-13.5-3.15.2
postgresql14-devel-14.1-3.3.1
postgresql14-server-devel-14.1-3.3.1
SUSE OpenStack Cloud 8
libecpg6-14.1-3.3.1
libpq5-14.1-3.3.1
libpq5-32bit-14.1-3.3.1
postgresql-14-4.10.1
postgresql-contrib-14-4.10.1
postgresql-docs-14-4.10.1
postgresql-plperl-14-4.10.1
postgresql-plpython-14-4.10.1
postgresql-pltcl-14-4.10.1
postgresql-server-14-4.10.1
SUSE OpenStack Cloud 9
libecpg6-14.1-3.3.1
libpq5-14.1-3.3.1
libpq5-32bit-14.1-3.3.1
postgresql-14-4.10.1
postgresql-contrib-14-4.10.1
postgresql-docs-14-4.10.1
postgresql-plperl-14-4.10.1
postgresql-plpython-14-4.10.1
postgresql-pltcl-14-4.10.1
postgresql-server-14-4.10.1
SUSE OpenStack Cloud Crowbar 8
libecpg6-14.1-3.3.1
libpq5-14.1-3.3.1
libpq5-32bit-14.1-3.3.1
postgresql-14-4.10.1
postgresql-contrib-14-4.10.1
postgresql-docs-14-4.10.1
postgresql-plperl-14-4.10.1
postgresql-plpython-14-4.10.1
postgresql-pltcl-14-4.10.1
postgresql-server-14-4.10.1
SUSE OpenStack Cloud Crowbar 9
libecpg6-14.1-3.3.1
libpq5-14.1-3.3.1
libpq5-32bit-14.1-3.3.1
postgresql-14-4.10.1
postgresql-contrib-14-4.10.1
postgresql-docs-14-4.10.1
postgresql-plperl-14-4.10.1
postgresql-plpython-14-4.10.1
postgresql-pltcl-14-4.10.1
postgresql-server-14-4.10.1

Ссылки

Описание

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

Затронутые продукты
HPE Helion OpenStack 8:libecpg6-14.1-3.3.1
HPE Helion OpenStack 8:libpq5-14.1-3.3.1
HPE Helion OpenStack 8:libpq5-32bit-14.1-3.3.1
HPE Helion OpenStack 8:postgresql-14-4.10.1
Ссылки

Описание

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

Затронутые продукты
HPE Helion OpenStack 8:libecpg6-14.1-3.3.1
HPE Helion OpenStack 8:libpq5-14.1-3.3.1
HPE Helion OpenStack 8:libpq5-32bit-14.1-3.3.1
HPE Helion OpenStack 8:postgresql-14-4.10.1
Ссылки
Уязвимость SUSE-SU-2021:3755-1