Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2021:3762-1

Опубликовано: 22 нояб. 2021
Источник: suse-cvrf

Описание

Security update for postgresql13

This update for postgresql13 fixes the following issues:

  • CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
  • CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).

Список пакетов

Container suse/postgres:13
postgresql13-13.5-5.22.1
postgresql13-server-13.5-5.22.1
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure
postgresql13-13.5-5.22.1
postgresql13-contrib-13.5-5.22.1
postgresql13-server-13.5-5.22.1
Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM
postgresql13-13.5-5.22.1
postgresql13-contrib-13.5-5.22.1
postgresql13-server-13.5-5.22.1
Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE
postgresql13-13.5-5.22.1
postgresql13-contrib-13.5-5.22.1
postgresql13-server-13.5-5.22.1
SUSE Linux Enterprise Module for Basesystem 15 SP2
postgresql13-13.5-5.22.1
SUSE Linux Enterprise Module for Basesystem 15 SP3
postgresql13-13.5-5.22.1
SUSE Linux Enterprise Module for Package Hub 15 SP2
postgresql13-llvmjit-13.5-5.22.1
postgresql13-test-13.5-5.22.1
SUSE Linux Enterprise Module for Package Hub 15 SP3
postgresql13-llvmjit-13.5-5.22.1
postgresql13-test-13.5-5.22.1
SUSE Linux Enterprise Module for Server Applications 15 SP2
postgresql13-contrib-13.5-5.22.1
postgresql13-devel-13.5-5.22.1
postgresql13-docs-13.5-5.22.1
postgresql13-plperl-13.5-5.22.1
postgresql13-plpython-13.5-5.22.1
postgresql13-pltcl-13.5-5.22.1
postgresql13-server-13.5-5.22.1
postgresql13-server-devel-13.5-5.22.1
SUSE Linux Enterprise Module for Server Applications 15 SP3
postgresql13-contrib-13.5-5.22.1
postgresql13-devel-13.5-5.22.1
postgresql13-docs-13.5-5.22.1
postgresql13-plperl-13.5-5.22.1
postgresql13-plpython-13.5-5.22.1
postgresql13-pltcl-13.5-5.22.1
postgresql13-server-13.5-5.22.1
postgresql13-server-devel-13.5-5.22.1

Ссылки

Описание

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

Затронутые продукты
Container suse/postgres:13:postgresql13-13.5-5.22.1
Container suse/postgres:13:postgresql13-server-13.5-5.22.1
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:postgresql13-13.5-5.22.1
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:postgresql13-contrib-13.5-5.22.1
Ссылки

Описание

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

Затронутые продукты
Container suse/postgres:13:postgresql13-13.5-5.22.1
Container suse/postgres:13:postgresql13-server-13.5-5.22.1
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:postgresql13-13.5-5.22.1
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:postgresql13-contrib-13.5-5.22.1
Ссылки