Описание
Security update for postgresql10
This update for postgresql10 fixes the following issues:
Security issue fixed:
- CVE-2018-16850: Fixed improper quoting of transition table names when pg_dump emits CREATE TRIGGER could have caused privilege escalation (bsc#1114837).
Non-security issues fixed:
- Update to release 10.6:
This update was imported from the SUSE:SLE-15:Update update project.
Список пакетов
openSUSE Leap 15.0
libecpg6-10.6-lp150.3.6.1
libecpg6-32bit-10.6-lp150.3.6.1
libpq5-10.6-lp150.3.6.1
libpq5-32bit-10.6-lp150.3.6.1
postgresql10-10.6-lp150.3.6.1
postgresql10-contrib-10.6-lp150.3.6.1
postgresql10-devel-10.6-lp150.3.6.1
postgresql10-docs-10.6-lp150.3.6.1
postgresql10-plperl-10.6-lp150.3.6.1
postgresql10-plpython-10.6-lp150.3.6.1
postgresql10-pltcl-10.6-lp150.3.6.1
postgresql10-server-10.6-lp150.3.6.1
postgresql10-test-10.6-lp150.3.6.1
Ссылки
- E-Mail link for openSUSE-SU-2018:4031-1
- SUSE Security Ratings
Описание
postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.
Затронутые продукты
openSUSE Leap 15.0:libecpg6-10.6-lp150.3.6.1
openSUSE Leap 15.0:libecpg6-32bit-10.6-lp150.3.6.1
openSUSE Leap 15.0:libpq5-10.6-lp150.3.6.1
openSUSE Leap 15.0:libpq5-32bit-10.6-lp150.3.6.1
Ссылки
- CVE-2018-16850
- SUSE Bug 1114837