SUSE update for postgresql, postgresql16, postgresql17
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 4 |
| CVE-ID | CVE-2024-10976 CVE-2024-10977 CVE-2024-10978 CVE-2024-10979 |
| CWE-ID | CWE-269 CWE-300 CWE-266 CWE-285 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
SUSE Package Hub 15 Operating systems & Components / Operating system Server Applications Module Operating systems & Components / Operating system Basesystem Module Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop 15 Operating systems & Components / Operating system libpq5-64bit Operating systems & Components / Operating system package or component libecpg6-64bit-debuginfo Operating systems & Components / Operating system package or component libpq5-64bit-debuginfo Operating systems & Components / Operating system package or component libecpg6-64bit Operating systems & Components / Operating system package or component libecpg6-32bit-debuginfo Operating systems & Components / Operating system package or component libpq5-32bit Operating systems & Components / Operating system package or component libpq5-32bit-debuginfo Operating systems & Components / Operating system package or component libecpg6-32bit Operating systems & Components / Operating system package or component postgresql16-server-devel Operating systems & Components / Operating system package or component postgresql17-contrib Operating systems & Components / Operating system package or component postgresql17-devel Operating systems & Components / Operating system package or component postgresql16-pltcl-debuginfo Operating systems & Components / Operating system package or component postgresql16-devel Operating systems & Components / Operating system package or component postgresql17-mini-debugsource Operating systems & Components / Operating system package or component postgresql16-server Operating systems & Components / Operating system package or component postgresql16-pltcl Operating systems & Components / Operating system package or component postgresql16-plperl Operating systems & Components / Operating system package or component postgresql17-server-devel Operating systems & Components / Operating system package or component postgresql17-plperl-debuginfo Operating systems & Components / Operating system package or component postgresql17-plperl Operating systems & Components / Operating system package or component postgresql17-pltcl-debuginfo Operating systems & Components / Operating system package or component postgresql16-debuginfo Operating systems & Components / Operating system package or component postgresql17-devel-mini-debuginfo Operating systems & Components / Operating system package or component libpq5 Operating systems & Components / Operating system package or component postgresql17-server Operating systems & Components / Operating system package or component postgresql16-plperl-debuginfo Operating systems & Components / Operating system package or component postgresql17-test Operating systems & Components / Operating system package or component postgresql16 Operating systems & Components / Operating system package or component postgresql16-debugsource Operating systems & Components / Operating system package or component postgresql16-llvmjit-debuginfo Operating systems & Components / Operating system package or component postgresql17-plpython Operating systems & Components / Operating system package or component postgresql17-llvmjit Operating systems & Components / Operating system package or component postgresql16-llvmjit-devel Operating systems & Components / Operating system package or component postgresql16-server-debuginfo Operating systems & Components / Operating system package or component postgresql16-contrib-debuginfo Operating systems & Components / Operating system package or component postgresql17-pltcl Operating systems & Components / Operating system package or component postgresql16-devel-debuginfo Operating systems & Components / Operating system package or component postgresql17-server-debuginfo Operating systems & Components / Operating system package or component postgresql17-llvmjit-devel Operating systems & Components / Operating system package or component postgresql17-contrib-debuginfo Operating systems & Components / Operating system package or component postgresql16-plpython-debuginfo Operating systems & Components / Operating system package or component postgresql16-server-devel-debuginfo Operating systems & Components / Operating system package or component libpq5-debuginfo Operating systems & Components / Operating system package or component postgresql17-devel-debuginfo Operating systems & Components / Operating system package or component postgresql17-debugsource Operating systems & Components / Operating system package or component postgresql16-contrib Operating systems & Components / Operating system package or component postgresql17-server-devel-debuginfo Operating systems & Components / Operating system package or component libecpg6 Operating systems & Components / Operating system package or component postgresql17 Operating systems & Components / Operating system package or component postgresql17-plpython-debuginfo Operating systems & Components / Operating system package or component libecpg6-debuginfo Operating systems & Components / Operating system package or component postgresql16-llvmjit Operating systems & Components / Operating system package or component postgresql16-test Operating systems & Components / Operating system package or component postgresql17-llvmjit-debuginfo Operating systems & Components / Operating system package or component postgresql17-debuginfo Operating systems & Components / Operating system package or component postgresql16-plpython Operating systems & Components / Operating system package or component postgresql17-devel-mini Operating systems & Components / Operating system package or component postgresql-plperl Operating systems & Components / Operating system package or component postgresql-devel Operating systems & Components / Operating system package or component postgresql-test Operating systems & Components / Operating system package or component postgresql17-docs Operating systems & Components / Operating system package or component postgresql-pltcl Operating systems & Components / Operating system package or component postgresql-plpython Operating systems & Components / Operating system package or component postgresql Operating systems & Components / Operating system package or component postgresql-llvmjit Operating systems & Components / Operating system package or component postgresql16-docs Operating systems & Components / Operating system package or component postgresql-server Operating systems & Components / Operating system package or component postgresql-server-devel Operating systems & Components / Operating system package or component postgresql-contrib Operating systems & Components / Operating system package or component postgresql-llvmjit-devel Operating systems & Components / Operating system package or component postgresql-docs Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
1) Improper privilege management
EUVDB-ID: #VU100511
Risk: Medium
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-10976
CWE-ID:
CWE-269 - Improper Privilege Management
Exploit availability: No
DescriptionThe vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to improper privilege management in cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. A remote user can bypass implemented security restrictions and gain unauthorized access to the database in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles.
MitigationUpdate the affected package postgresql, postgresql16, postgresql17 to the latest version.
Vulnerable software versionsSUSE Package Hub 15: 15-SP6
Server Applications Module: 15-SP6
Basesystem Module: 15-SP6
SUSE Linux Enterprise Real Time 15: SP6
openSUSE Leap: 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP6
SUSE Linux Enterprise Server 15: SP6
SUSE Linux Enterprise Desktop 15: SP6
libpq5-64bit: before 17.2-150600.13.5.1
libecpg6-64bit-debuginfo: before 17.2-150600.13.5.1
libpq5-64bit-debuginfo: before 17.2-150600.13.5.1
libecpg6-64bit: before 17.2-150600.13.5.1
libecpg6-32bit-debuginfo: before 17.2-150600.13.5.1
libpq5-32bit: before 17.2-150600.13.5.1
libpq5-32bit-debuginfo: before 17.2-150600.13.5.1
libecpg6-32bit: before 17.2-150600.13.5.1
postgresql16-server-devel: before 16.6-150600.16.10.1
postgresql17-contrib: before 17.2-150600.13.5.1
postgresql17-devel: before 17.2-150600.13.5.1
postgresql16-pltcl-debuginfo: before 16.6-150600.16.10.1
postgresql16-devel: before 16.6-150600.16.10.1
postgresql17-mini-debugsource: before 17.2-150600.13.5.1
postgresql16-server: before 16.6-150600.16.10.1
postgresql16-pltcl: before 16.6-150600.16.10.1
postgresql16-plperl: before 16.6-150600.16.10.1
postgresql17-server-devel: before 17.2-150600.13.5.1
postgresql17-plperl-debuginfo: before 17.2-150600.13.5.1
postgresql17-plperl: before 17.2-150600.13.5.1
postgresql17-pltcl-debuginfo: before 17.2-150600.13.5.1
postgresql16-debuginfo: before 16.6-150600.16.10.1
postgresql17-devel-mini-debuginfo: before 17.2-150600.13.5.1
libpq5: before 17.2-150600.13.5.1
postgresql17-server: before 17.2-150600.13.5.1
postgresql16-plperl-debuginfo: before 16.6-150600.16.10.1
postgresql17-test: before 17.2-150600.13.5.1
postgresql16: before 16.6-150600.16.10.1
postgresql16-debugsource: before 16.6-150600.16.10.1
postgresql16-llvmjit-debuginfo: before 16.6-150600.16.10.1
postgresql17-plpython: before 17.2-150600.13.5.1
postgresql17-llvmjit: before 17.2-150600.13.5.1
postgresql16-llvmjit-devel: before 16.6-150600.16.10.1
postgresql16-server-debuginfo: before 16.6-150600.16.10.1
postgresql16-contrib-debuginfo: before 16.6-150600.16.10.1
postgresql17-pltcl: before 17.2-150600.13.5.1
postgresql16-devel-debuginfo: before 16.6-150600.16.10.1
postgresql17-server-debuginfo: before 17.2-150600.13.5.1
postgresql17-llvmjit-devel: before 17.2-150600.13.5.1
postgresql17-contrib-debuginfo: before 17.2-150600.13.5.1
postgresql16-plpython-debuginfo: before 16.6-150600.16.10.1
postgresql16-server-devel-debuginfo: before 16.6-150600.16.10.1
libpq5-debuginfo: before 17.2-150600.13.5.1
postgresql17-devel-debuginfo: before 17.2-150600.13.5.1
postgresql17-debugsource: before 17.2-150600.13.5.1
postgresql16-contrib: before 16.6-150600.16.10.1
postgresql17-server-devel-debuginfo: before 17.2-150600.13.5.1
libecpg6: before 17.2-150600.13.5.1
postgresql17: before 17.2-150600.13.5.1
postgresql17-plpython-debuginfo: before 17.2-150600.13.5.1
libecpg6-debuginfo: before 17.2-150600.13.5.1
postgresql16-llvmjit: before 16.6-150600.16.10.1
postgresql16-test: before 16.6-150600.16.10.1
postgresql17-llvmjit-debuginfo: before 17.2-150600.13.5.1
postgresql17-debuginfo: before 17.2-150600.13.5.1
postgresql16-plpython: before 16.6-150600.16.10.1
postgresql17-devel-mini: before 17.2-150600.13.5.1
postgresql-plperl: before 17-150600.17.6.1
postgresql-devel: before 17-150600.17.6.1
postgresql-test: before 17-150600.17.6.1
postgresql17-docs: before 17.2-150600.13.5.1
postgresql-pltcl: before 17-150600.17.6.1
postgresql-plpython: before 17-150600.17.6.1
postgresql: before 17-150600.17.6.1
postgresql-llvmjit: before 17-150600.17.6.1
postgresql16-docs: before 16.6-150600.16.10.1
postgresql-server: before 17-150600.17.6.1
postgresql-server-devel: before 17-150600.17.6.1
postgresql-contrib: before 17-150600.17.6.1
postgresql-llvmjit-devel: before 17-150600.17.6.1
postgresql-docs: before 17-150600.17.6.1
CPE2.3- cpe:2.3:o:suse:suse_package_hub_15:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:server_applications_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libpq5-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-pltcl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-mini-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plperl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-pltcl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel-mini-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plperl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-llvmjit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-contrib-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-contrib-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plpython-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plpython-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-llvmjit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel-mini:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-docs:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2024/suse-su-20244063-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Man-in-the-Middle (MitM) attack
EUVDB-ID: #VU100512
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-10977
CWE-ID:
CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to spoof error messages from the database.
The vulnerability exists due to an error in libpq, which allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. A remote attacker can perform a man-in-the-middle attack to send a long error message that a human or screen-scraper user of psql mistakes for valid query results.
MitigationUpdate the affected package postgresql, postgresql16, postgresql17 to the latest version.
Vulnerable software versionsSUSE Package Hub 15: 15-SP6
Server Applications Module: 15-SP6
Basesystem Module: 15-SP6
SUSE Linux Enterprise Real Time 15: SP6
openSUSE Leap: 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP6
SUSE Linux Enterprise Server 15: SP6
SUSE Linux Enterprise Desktop 15: SP6
libpq5-64bit: before 17.2-150600.13.5.1
libecpg6-64bit-debuginfo: before 17.2-150600.13.5.1
libpq5-64bit-debuginfo: before 17.2-150600.13.5.1
libecpg6-64bit: before 17.2-150600.13.5.1
libecpg6-32bit-debuginfo: before 17.2-150600.13.5.1
libpq5-32bit: before 17.2-150600.13.5.1
libpq5-32bit-debuginfo: before 17.2-150600.13.5.1
libecpg6-32bit: before 17.2-150600.13.5.1
postgresql16-server-devel: before 16.6-150600.16.10.1
postgresql17-contrib: before 17.2-150600.13.5.1
postgresql17-devel: before 17.2-150600.13.5.1
postgresql16-pltcl-debuginfo: before 16.6-150600.16.10.1
postgresql16-devel: before 16.6-150600.16.10.1
postgresql17-mini-debugsource: before 17.2-150600.13.5.1
postgresql16-server: before 16.6-150600.16.10.1
postgresql16-pltcl: before 16.6-150600.16.10.1
postgresql16-plperl: before 16.6-150600.16.10.1
postgresql17-server-devel: before 17.2-150600.13.5.1
postgresql17-plperl-debuginfo: before 17.2-150600.13.5.1
postgresql17-plperl: before 17.2-150600.13.5.1
postgresql17-pltcl-debuginfo: before 17.2-150600.13.5.1
postgresql16-debuginfo: before 16.6-150600.16.10.1
postgresql17-devel-mini-debuginfo: before 17.2-150600.13.5.1
libpq5: before 17.2-150600.13.5.1
postgresql17-server: before 17.2-150600.13.5.1
postgresql16-plperl-debuginfo: before 16.6-150600.16.10.1
postgresql17-test: before 17.2-150600.13.5.1
postgresql16: before 16.6-150600.16.10.1
postgresql16-debugsource: before 16.6-150600.16.10.1
postgresql16-llvmjit-debuginfo: before 16.6-150600.16.10.1
postgresql17-plpython: before 17.2-150600.13.5.1
postgresql17-llvmjit: before 17.2-150600.13.5.1
postgresql16-llvmjit-devel: before 16.6-150600.16.10.1
postgresql16-server-debuginfo: before 16.6-150600.16.10.1
postgresql16-contrib-debuginfo: before 16.6-150600.16.10.1
postgresql17-pltcl: before 17.2-150600.13.5.1
postgresql16-devel-debuginfo: before 16.6-150600.16.10.1
postgresql17-server-debuginfo: before 17.2-150600.13.5.1
postgresql17-llvmjit-devel: before 17.2-150600.13.5.1
postgresql17-contrib-debuginfo: before 17.2-150600.13.5.1
postgresql16-plpython-debuginfo: before 16.6-150600.16.10.1
postgresql16-server-devel-debuginfo: before 16.6-150600.16.10.1
libpq5-debuginfo: before 17.2-150600.13.5.1
postgresql17-devel-debuginfo: before 17.2-150600.13.5.1
postgresql17-debugsource: before 17.2-150600.13.5.1
postgresql16-contrib: before 16.6-150600.16.10.1
postgresql17-server-devel-debuginfo: before 17.2-150600.13.5.1
libecpg6: before 17.2-150600.13.5.1
postgresql17: before 17.2-150600.13.5.1
postgresql17-plpython-debuginfo: before 17.2-150600.13.5.1
libecpg6-debuginfo: before 17.2-150600.13.5.1
postgresql16-llvmjit: before 16.6-150600.16.10.1
postgresql16-test: before 16.6-150600.16.10.1
postgresql17-llvmjit-debuginfo: before 17.2-150600.13.5.1
postgresql17-debuginfo: before 17.2-150600.13.5.1
postgresql16-plpython: before 16.6-150600.16.10.1
postgresql17-devel-mini: before 17.2-150600.13.5.1
postgresql-plperl: before 17-150600.17.6.1
postgresql-devel: before 17-150600.17.6.1
postgresql-test: before 17-150600.17.6.1
postgresql17-docs: before 17.2-150600.13.5.1
postgresql-pltcl: before 17-150600.17.6.1
postgresql-plpython: before 17-150600.17.6.1
postgresql: before 17-150600.17.6.1
postgresql-llvmjit: before 17-150600.17.6.1
postgresql16-docs: before 16.6-150600.16.10.1
postgresql-server: before 17-150600.17.6.1
postgresql-server-devel: before 17-150600.17.6.1
postgresql-contrib: before 17-150600.17.6.1
postgresql-llvmjit-devel: before 17-150600.17.6.1
postgresql-docs: before 17-150600.17.6.1
CPE2.3- cpe:2.3:o:suse:suse_package_hub_15:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:server_applications_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libpq5-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-pltcl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-mini-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plperl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-pltcl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel-mini-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plperl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-llvmjit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-contrib-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-contrib-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plpython-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plpython-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-llvmjit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel-mini:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-docs:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2024/suse-su-20244063-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Incorrect privilege assignment
EUVDB-ID: #VU100513
Risk: Medium
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-10978
CWE-ID:
CWE-266 - Incorrect Privilege Assignment
Exploit availability: No
DescriptionThe vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to incorrect privilege assignment when application uses SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. A remote user can force the application to reset their role to a wrong user ID and view or change different rows from those intended.
MitigationUpdate the affected package postgresql, postgresql16, postgresql17 to the latest version.
Vulnerable software versionsSUSE Package Hub 15: 15-SP6
Server Applications Module: 15-SP6
Basesystem Module: 15-SP6
SUSE Linux Enterprise Real Time 15: SP6
openSUSE Leap: 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP6
SUSE Linux Enterprise Server 15: SP6
SUSE Linux Enterprise Desktop 15: SP6
libpq5-64bit: before 17.2-150600.13.5.1
libecpg6-64bit-debuginfo: before 17.2-150600.13.5.1
libpq5-64bit-debuginfo: before 17.2-150600.13.5.1
libecpg6-64bit: before 17.2-150600.13.5.1
libecpg6-32bit-debuginfo: before 17.2-150600.13.5.1
libpq5-32bit: before 17.2-150600.13.5.1
libpq5-32bit-debuginfo: before 17.2-150600.13.5.1
libecpg6-32bit: before 17.2-150600.13.5.1
postgresql16-server-devel: before 16.6-150600.16.10.1
postgresql17-contrib: before 17.2-150600.13.5.1
postgresql17-devel: before 17.2-150600.13.5.1
postgresql16-pltcl-debuginfo: before 16.6-150600.16.10.1
postgresql16-devel: before 16.6-150600.16.10.1
postgresql17-mini-debugsource: before 17.2-150600.13.5.1
postgresql16-server: before 16.6-150600.16.10.1
postgresql16-pltcl: before 16.6-150600.16.10.1
postgresql16-plperl: before 16.6-150600.16.10.1
postgresql17-server-devel: before 17.2-150600.13.5.1
postgresql17-plperl-debuginfo: before 17.2-150600.13.5.1
postgresql17-plperl: before 17.2-150600.13.5.1
postgresql17-pltcl-debuginfo: before 17.2-150600.13.5.1
postgresql16-debuginfo: before 16.6-150600.16.10.1
postgresql17-devel-mini-debuginfo: before 17.2-150600.13.5.1
libpq5: before 17.2-150600.13.5.1
postgresql17-server: before 17.2-150600.13.5.1
postgresql16-plperl-debuginfo: before 16.6-150600.16.10.1
postgresql17-test: before 17.2-150600.13.5.1
postgresql16: before 16.6-150600.16.10.1
postgresql16-debugsource: before 16.6-150600.16.10.1
postgresql16-llvmjit-debuginfo: before 16.6-150600.16.10.1
postgresql17-plpython: before 17.2-150600.13.5.1
postgresql17-llvmjit: before 17.2-150600.13.5.1
postgresql16-llvmjit-devel: before 16.6-150600.16.10.1
postgresql16-server-debuginfo: before 16.6-150600.16.10.1
postgresql16-contrib-debuginfo: before 16.6-150600.16.10.1
postgresql17-pltcl: before 17.2-150600.13.5.1
postgresql16-devel-debuginfo: before 16.6-150600.16.10.1
postgresql17-server-debuginfo: before 17.2-150600.13.5.1
postgresql17-llvmjit-devel: before 17.2-150600.13.5.1
postgresql17-contrib-debuginfo: before 17.2-150600.13.5.1
postgresql16-plpython-debuginfo: before 16.6-150600.16.10.1
postgresql16-server-devel-debuginfo: before 16.6-150600.16.10.1
libpq5-debuginfo: before 17.2-150600.13.5.1
postgresql17-devel-debuginfo: before 17.2-150600.13.5.1
postgresql17-debugsource: before 17.2-150600.13.5.1
postgresql16-contrib: before 16.6-150600.16.10.1
postgresql17-server-devel-debuginfo: before 17.2-150600.13.5.1
libecpg6: before 17.2-150600.13.5.1
postgresql17: before 17.2-150600.13.5.1
postgresql17-plpython-debuginfo: before 17.2-150600.13.5.1
libecpg6-debuginfo: before 17.2-150600.13.5.1
postgresql16-llvmjit: before 16.6-150600.16.10.1
postgresql16-test: before 16.6-150600.16.10.1
postgresql17-llvmjit-debuginfo: before 17.2-150600.13.5.1
postgresql17-debuginfo: before 17.2-150600.13.5.1
postgresql16-plpython: before 16.6-150600.16.10.1
postgresql17-devel-mini: before 17.2-150600.13.5.1
postgresql-plperl: before 17-150600.17.6.1
postgresql-devel: before 17-150600.17.6.1
postgresql-test: before 17-150600.17.6.1
postgresql17-docs: before 17.2-150600.13.5.1
postgresql-pltcl: before 17-150600.17.6.1
postgresql-plpython: before 17-150600.17.6.1
postgresql: before 17-150600.17.6.1
postgresql-llvmjit: before 17-150600.17.6.1
postgresql16-docs: before 16.6-150600.16.10.1
postgresql-server: before 17-150600.17.6.1
postgresql-server-devel: before 17-150600.17.6.1
postgresql-contrib: before 17-150600.17.6.1
postgresql-llvmjit-devel: before 17-150600.17.6.1
postgresql-docs: before 17-150600.17.6.1
CPE2.3- cpe:2.3:o:suse:suse_package_hub_15:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:server_applications_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libpq5-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-pltcl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-mini-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plperl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-pltcl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel-mini-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plperl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-llvmjit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-contrib-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-contrib-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plpython-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plpython-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-llvmjit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel-mini:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-docs:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2024/suse-su-20244063-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Improper authorization
EUVDB-ID: #VU100514
Risk: High
CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-10979
CWE-ID:
CWE-285 - Improper Authorization
Exploit availability: No
DescriptionThe vulnerability allows a remote user to compromise the affected system.
The vulnerability exists due to incorrect control of environment variables. A remote unprivileged database user can change sensitive process environment variables (e.g. PATH) and execute arbitrary code on the database server.
Update the affected package postgresql, postgresql16, postgresql17 to the latest version.
Vulnerable software versionsSUSE Package Hub 15: 15-SP6
Server Applications Module: 15-SP6
Basesystem Module: 15-SP6
SUSE Linux Enterprise Real Time 15: SP6
openSUSE Leap: 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP6
SUSE Linux Enterprise Server 15: SP6
SUSE Linux Enterprise Desktop 15: SP6
libpq5-64bit: before 17.2-150600.13.5.1
libecpg6-64bit-debuginfo: before 17.2-150600.13.5.1
libpq5-64bit-debuginfo: before 17.2-150600.13.5.1
libecpg6-64bit: before 17.2-150600.13.5.1
libecpg6-32bit-debuginfo: before 17.2-150600.13.5.1
libpq5-32bit: before 17.2-150600.13.5.1
libpq5-32bit-debuginfo: before 17.2-150600.13.5.1
libecpg6-32bit: before 17.2-150600.13.5.1
postgresql16-server-devel: before 16.6-150600.16.10.1
postgresql17-contrib: before 17.2-150600.13.5.1
postgresql17-devel: before 17.2-150600.13.5.1
postgresql16-pltcl-debuginfo: before 16.6-150600.16.10.1
postgresql16-devel: before 16.6-150600.16.10.1
postgresql17-mini-debugsource: before 17.2-150600.13.5.1
postgresql16-server: before 16.6-150600.16.10.1
postgresql16-pltcl: before 16.6-150600.16.10.1
postgresql16-plperl: before 16.6-150600.16.10.1
postgresql17-server-devel: before 17.2-150600.13.5.1
postgresql17-plperl-debuginfo: before 17.2-150600.13.5.1
postgresql17-plperl: before 17.2-150600.13.5.1
postgresql17-pltcl-debuginfo: before 17.2-150600.13.5.1
postgresql16-debuginfo: before 16.6-150600.16.10.1
postgresql17-devel-mini-debuginfo: before 17.2-150600.13.5.1
libpq5: before 17.2-150600.13.5.1
postgresql17-server: before 17.2-150600.13.5.1
postgresql16-plperl-debuginfo: before 16.6-150600.16.10.1
postgresql17-test: before 17.2-150600.13.5.1
postgresql16: before 16.6-150600.16.10.1
postgresql16-debugsource: before 16.6-150600.16.10.1
postgresql16-llvmjit-debuginfo: before 16.6-150600.16.10.1
postgresql17-plpython: before 17.2-150600.13.5.1
postgresql17-llvmjit: before 17.2-150600.13.5.1
postgresql16-llvmjit-devel: before 16.6-150600.16.10.1
postgresql16-server-debuginfo: before 16.6-150600.16.10.1
postgresql16-contrib-debuginfo: before 16.6-150600.16.10.1
postgresql17-pltcl: before 17.2-150600.13.5.1
postgresql16-devel-debuginfo: before 16.6-150600.16.10.1
postgresql17-server-debuginfo: before 17.2-150600.13.5.1
postgresql17-llvmjit-devel: before 17.2-150600.13.5.1
postgresql17-contrib-debuginfo: before 17.2-150600.13.5.1
postgresql16-plpython-debuginfo: before 16.6-150600.16.10.1
postgresql16-server-devel-debuginfo: before 16.6-150600.16.10.1
libpq5-debuginfo: before 17.2-150600.13.5.1
postgresql17-devel-debuginfo: before 17.2-150600.13.5.1
postgresql17-debugsource: before 17.2-150600.13.5.1
postgresql16-contrib: before 16.6-150600.16.10.1
postgresql17-server-devel-debuginfo: before 17.2-150600.13.5.1
libecpg6: before 17.2-150600.13.5.1
postgresql17: before 17.2-150600.13.5.1
postgresql17-plpython-debuginfo: before 17.2-150600.13.5.1
libecpg6-debuginfo: before 17.2-150600.13.5.1
postgresql16-llvmjit: before 16.6-150600.16.10.1
postgresql16-test: before 16.6-150600.16.10.1
postgresql17-llvmjit-debuginfo: before 17.2-150600.13.5.1
postgresql17-debuginfo: before 17.2-150600.13.5.1
postgresql16-plpython: before 16.6-150600.16.10.1
postgresql17-devel-mini: before 17.2-150600.13.5.1
postgresql-plperl: before 17-150600.17.6.1
postgresql-devel: before 17-150600.17.6.1
postgresql-test: before 17-150600.17.6.1
postgresql17-docs: before 17.2-150600.13.5.1
postgresql-pltcl: before 17-150600.17.6.1
postgresql-plpython: before 17-150600.17.6.1
postgresql: before 17-150600.17.6.1
postgresql-llvmjit: before 17-150600.17.6.1
postgresql16-docs: before 16.6-150600.16.10.1
postgresql-server: before 17-150600.17.6.1
postgresql-server-devel: before 17-150600.17.6.1
postgresql-contrib: before 17-150600.17.6.1
postgresql-llvmjit-devel: before 17-150600.17.6.1
postgresql-docs: before 17-150600.17.6.1
CPE2.3- cpe:2.3:o:suse:suse_package_hub_15:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:server_applications_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libpq5-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-64bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-64bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-pltcl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-mini-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plperl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-pltcl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel-mini-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plperl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-llvmjit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-contrib-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-contrib-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plpython-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-server-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpq5-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-server-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-plpython-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libecpg6-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-llvmjit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-devel-mini:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql17-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql16-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:postgresql-docs:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2024/suse-su-20244063-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
