ΠΠΏΠΈΡΠ°Π½ΠΈΠ΅
Security update for postgresql12
This update for postgresql12 fixes the following issues:
- CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
- CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
Π‘ΠΏΠΈΡΠΎΠΊ ΠΏΠ°ΠΊΠ΅ΡΠΎΠ²
openSUSE Leap 15.3
postgresql12-12.9-8.26.1
postgresql12-contrib-12.9-8.26.1
postgresql12-devel-12.9-8.26.1
postgresql12-docs-12.9-8.26.1
postgresql12-llvmjit-12.9-8.26.1
postgresql12-plperl-12.9-8.26.1
postgresql12-plpython-12.9-8.26.1
postgresql12-pltcl-12.9-8.26.1
postgresql12-server-12.9-8.26.1
postgresql12-server-devel-12.9-8.26.1
postgresql12-test-12.9-8.26.1
Π‘ΡΡΠ»ΠΊΠΈ
- E-Mail link for openSUSE-SU-2021:3758-1
- SUSE Security Ratings
- SUSE Bug 1192516
- SUSE CVE CVE-2021-23214 page
- SUSE CVE CVE-2021-23222 page
ΠΠΏΠΈΡΠ°Π½ΠΈΠ΅
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
ΠΠ°ΡΡΠΎΠ½ΡΡΡΠ΅ ΠΏΡΠΎΠ΄ΡΠΊΡΡ
openSUSE Leap 15.3:postgresql12-12.9-8.26.1
openSUSE Leap 15.3:postgresql12-contrib-12.9-8.26.1
openSUSE Leap 15.3:postgresql12-devel-12.9-8.26.1
openSUSE Leap 15.3:postgresql12-docs-12.9-8.26.1
Π‘ΡΡΠ»ΠΊΠΈ
- CVE-2021-23214
- SUSE Bug 1192516
ΠΠΏΠΈΡΠ°Π½ΠΈΠ΅
A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.
ΠΠ°ΡΡΠΎΠ½ΡΡΡΠ΅ ΠΏΡΠΎΠ΄ΡΠΊΡΡ
openSUSE Leap 15.3:postgresql12-12.9-8.26.1
openSUSE Leap 15.3:postgresql12-contrib-12.9-8.26.1
openSUSE Leap 15.3:postgresql12-devel-12.9-8.26.1
openSUSE Leap 15.3:postgresql12-docs-12.9-8.26.1
Π‘ΡΡΠ»ΠΊΠΈ
- CVE-2021-23222
- SUSE Bug 1192516