SB2020081802 - OpenSUSE Linux update for postgresql96, postgresql10 and postgresql12

Description

This security bulletin contains information about 7 secuirty vulnerabilities.

1) SQL injection (CVE-ID: CVE-2018-10915)

The vulnerability allows a remote attacker to execute arbitrary SQL commands in web application database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL commands in web application database.

Successful exploitation of the vulnerability may allow an attacker to gain administrative access to vulnerable web application.

2) Information disclosure (CVE-ID: CVE-2018-10925)

The vulnerability allows a remote privileged attacker to obtain potentially sensitive information.

The vulnerability exists due to improper check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". A remote attacker with "CREATE TABLE" privileges can read arbitrary bytes server memory.

3) Security restrictions bypass (CVE-ID: CVE-2018-1115)

The vulnerability allows a remote authenticated attacker to bypass security restrictions on the target system.

The weakness exists in the pg_catalog.pg_logfile_rotate() function due to improper Access Control List (ACL) restrictions as it does not follow the same ACLs as the pg_rorate_logfile function. A remote attacker can connect to the database and cause the target software to force log rotation, write log messages across arbitrary log files or cause the service to crash.

4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-10130)

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to incorrect implementation of row security policies. A remote attacker can use statistics, generated for tables to bypass row security policies and gain access to restricted rows.

5) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-10208)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to way PostreSQL processes SECURITY DEFINER functions. A privileged attacker with EXECUTE permission, which must itself contain a function call having inexact argument type match, can execute arbitrary SQL query under the identity of the function owner.

6) Untrusted search path (CVE-ID: CVE-2020-14350)

The vulnerability allows a remote user to escalate privileges within the database.

The vulnerability exists due to the way PostgreSQL handles CREATE EXTENSION statements. A remote user with permission to create objects in the new extension's schema or a schema of a prerequisite extension can execute arbitrary SQL functions under the identity of the superuser in certain cases.

7) Improper Authorization (CVE-ID: CVE-2020-1720)

The vulnerability allows a remote attacker to perform unauthorized modification of data in database.

The vulnerability exists due to the ALTER ... DEPENDS ON EXTENSION sub-commands do not perform authorization checks, which can allow an unprivileged user to drop any function, procedure, materialized view, index, or trigger under certain conditions. This attack is possible if an administrator has installed an extension and an unprivileged user can CREATE, or an extension owner either executes DROP EXTENSION predictably or can be convinced to execute DROP EXTENSION.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html