SUSE update for postgresql16



Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2024-0985
CWE-ID CWE-269
Exploitation vector Network
Public exploit N/A
Vulnerable software
SUSE Linux Enterprise Server 15 SP4 LTSS
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing LTSS 15
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing ESPOS 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Desktop 15 SP4 LTSS
Operating systems & Components / Operating system

SUSE Linux Enterprise Micro
Operating systems & Components / Operating system

Server Applications Module
Operating systems & Components / Operating system

SUSE Package Hub 15
Operating systems & Components / Operating system

Basesystem Module
Operating systems & Components / Operating system

SUSE Linux Enterprise Server for SAP Applications 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Server 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Real Time 15
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Desktop 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Server 15 SP3 LTSS
Operating systems & Components / Operating system

SUSE Linux Enterprise Server 15 SP2 LTSS
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
Operating systems & Components / Operating system

openSUSE Leap
Operating systems & Components / Operating system

SUSE Enterprise Storage
Operating systems & Components / Operating system

SUSE Manager Retail Branch Server
Operating systems & Components / Operating system

SUSE Manager Server
Operating systems & Components / Operating system

SUSE Manager Proxy
Operating systems & Components / Operating system

libecpg6-32bit
Operating systems & Components / Operating system package or component

libecpg6-32bit-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-llvmjit
Operating systems & Components / Operating system package or component

postgresql16-llvmjit-devel
Operating systems & Components / Operating system package or component

postgresql16-devel-mini
Operating systems & Components / Operating system package or component

postgresql16-llvmjit-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-test
Operating systems & Components / Operating system package or component

postgresql16-devel-mini-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-mini-debugsource
Operating systems & Components / Operating system package or component

libpq5-32bit
Operating systems & Components / Operating system package or component

libpq5-32bit-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-docs
Operating systems & Components / Operating system package or component

postgresql16-server-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-plpython
Operating systems & Components / Operating system package or component

postgresql16-plpython-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-devel
Operating systems & Components / Operating system package or component

postgresql16-contrib
Operating systems & Components / Operating system package or component

postgresql16-pltcl-debuginfo
Operating systems & Components / Operating system package or component

postgresql16
Operating systems & Components / Operating system package or component

postgresql16-pltcl
Operating systems & Components / Operating system package or component

postgresql16-contrib-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-server
Operating systems & Components / Operating system package or component

postgresql16-plperl-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-plperl
Operating systems & Components / Operating system package or component

postgresql16-devel-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-server-devel
Operating systems & Components / Operating system package or component

postgresql16-server-devel-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-debugsource
Operating systems & Components / Operating system package or component

libpq5-debuginfo
Operating systems & Components / Operating system package or component

libecpg6
Operating systems & Components / Operating system package or component

postgresql16-debuginfo
Operating systems & Components / Operating system package or component

libecpg6-debuginfo
Operating systems & Components / Operating system package or component

libpq5
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Improper Privilege Management

EUVDB-ID: #VU86275

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-0985

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges within the database.

The vulnerability exists due to late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY. A remote user who is an object creator can execute arbitrary SQL functions as the command issuer.

Mitigation

Update the affected package postgresql16 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server 15 SP4 LTSS: 15-SP4

SUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP4

SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4

SUSE Linux Enterprise Desktop 15 SP4 LTSS: 15-SP4

SUSE Linux Enterprise Micro: 5.5

Server Applications Module: 15-SP5

SUSE Package Hub 15: 15-SP5

Basesystem Module: 15-SP5

SUSE Linux Enterprise Server for SAP Applications 15: SP2 - SP5

SUSE Linux Enterprise Server 15: SP2 - SP5

SUSE Linux Enterprise Real Time 15: SP5

SUSE Linux Enterprise High Performance Computing 15: SP2 - SP5

SUSE Linux Enterprise Desktop 15: SP5

SUSE Linux Enterprise Server 15 SP3 LTSS: 15-SP3

SUSE Linux Enterprise Server 15 SP2 LTSS: 15-SP2

SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS: 15-SP2

openSUSE Leap: 15.5

SUSE Enterprise Storage: 7.1

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

libecpg6-32bit: before 16.2-150200.5.10.1

libecpg6-32bit-debuginfo: before 16.2-150200.5.10.1

postgresql16-llvmjit: before 16.2-150200.5.10.1

postgresql16-llvmjit-devel: before 16.2-150200.5.10.1

postgresql16-devel-mini: before 16.2-150200.5.10.1

postgresql16-llvmjit-debuginfo: before 16.2-150200.5.10.1

postgresql16-test: before 16.2-150200.5.10.1

postgresql16-devel-mini-debuginfo: before 16.2-150200.5.10.1

postgresql16-mini-debugsource: before 16.2-150200.5.10.1

libpq5-32bit: before 16.2-150200.5.10.1

libpq5-32bit-debuginfo: before 16.2-150200.5.10.1

postgresql16-docs: before 16.2-150200.5.10.1

postgresql16-server-debuginfo: before 16.2-150200.5.10.1

postgresql16-plpython: before 16.2-150200.5.10.1

postgresql16-plpython-debuginfo: before 16.2-150200.5.10.1

postgresql16-devel: before 16.2-150200.5.10.1

postgresql16-contrib: before 16.2-150200.5.10.1

postgresql16-pltcl-debuginfo: before 16.2-150200.5.10.1

postgresql16: before 16.2-150200.5.10.1

postgresql16-pltcl: before 16.2-150200.5.10.1

postgresql16-contrib-debuginfo: before 16.2-150200.5.10.1

postgresql16-server: before 16.2-150200.5.10.1

postgresql16-plperl-debuginfo: before 16.2-150200.5.10.1

postgresql16-plperl: before 16.2-150200.5.10.1

postgresql16-devel-debuginfo: before 16.2-150200.5.10.1

postgresql16-server-devel: before 16.2-150200.5.10.1

postgresql16-server-devel-debuginfo: before 16.2-150200.5.10.1

postgresql16-debugsource: before 16.2-150200.5.10.1

libpq5-debuginfo: before 16.2-150200.5.10.1

libecpg6: before 16.2-150200.5.10.1

postgresql16-debuginfo: before 16.2-150200.5.10.1

libecpg6-debuginfo: before 16.2-150200.5.10.1

libpq5: before 16.2-150200.5.10.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2024/suse-su-20240550-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###