Описание
Security update for postgresql13
This update for postgresql13 fixes the following issues:
- CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
- CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake (bsc#1192516).
Список пакетов
openSUSE Leap 15.3
postgresql13-13.5-5.22.1
postgresql13-contrib-13.5-5.22.1
postgresql13-devel-13.5-5.22.1
postgresql13-docs-13.5-5.22.1
postgresql13-llvmjit-13.5-5.22.1
postgresql13-plperl-13.5-5.22.1
postgresql13-plpython-13.5-5.22.1
postgresql13-pltcl-13.5-5.22.1
postgresql13-server-13.5-5.22.1
postgresql13-server-devel-13.5-5.22.1
postgresql13-test-13.5-5.22.1
Ссылки
- E-Mail link for openSUSE-SU-2021:3762-1
- SUSE Security Ratings
- SUSE Bug 1192516
- SUSE CVE CVE-2021-23214 page
- SUSE CVE CVE-2021-23222 page
Описание
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.
Затронутые продукты
openSUSE Leap 15.3:postgresql13-13.5-5.22.1
openSUSE Leap 15.3:postgresql13-contrib-13.5-5.22.1
openSUSE Leap 15.3:postgresql13-devel-13.5-5.22.1
openSUSE Leap 15.3:postgresql13-docs-13.5-5.22.1
Ссылки
- CVE-2021-23214
- SUSE Bug 1192516
Описание
A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.
Затронутые продукты
openSUSE Leap 15.3:postgresql13-13.5-5.22.1
openSUSE Leap 15.3:postgresql13-contrib-13.5-5.22.1
openSUSE Leap 15.3:postgresql13-devel-13.5-5.22.1
openSUSE Leap 15.3:postgresql13-docs-13.5-5.22.1
Ссылки
- CVE-2021-23222
- SUSE Bug 1192516