SUSE update for postgresql, postgresql16, postgresql17



Risk High
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2024-10976
CVE-2024-10977
CVE-2024-10978
CVE-2024-10979
CWE-ID CWE-269
CWE-300
CWE-266
CWE-285
Exploitation vector Network
Public exploit N/A
Vulnerable software
SUSE Package Hub 15
Operating systems & Components / Operating system

Server Applications Module
Operating systems & Components / Operating system

Basesystem Module
Operating systems & Components / Operating system

SUSE Linux Enterprise Real Time 15
Operating systems & Components / Operating system

openSUSE Leap
Operating systems & Components / Operating system

SUSE Linux Enterprise Server for SAP Applications 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Server 15
Operating systems & Components / Operating system

SUSE Linux Enterprise Desktop 15
Operating systems & Components / Operating system

libpq5-64bit
Operating systems & Components / Operating system package or component

libecpg6-64bit-debuginfo
Operating systems & Components / Operating system package or component

libpq5-64bit-debuginfo
Operating systems & Components / Operating system package or component

libecpg6-64bit
Operating systems & Components / Operating system package or component

libecpg6-32bit-debuginfo
Operating systems & Components / Operating system package or component

libpq5-32bit
Operating systems & Components / Operating system package or component

libpq5-32bit-debuginfo
Operating systems & Components / Operating system package or component

libecpg6-32bit
Operating systems & Components / Operating system package or component

postgresql16-server-devel
Operating systems & Components / Operating system package or component

postgresql17-contrib
Operating systems & Components / Operating system package or component

postgresql17-devel
Operating systems & Components / Operating system package or component

postgresql16-pltcl-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-devel
Operating systems & Components / Operating system package or component

postgresql17-mini-debugsource
Operating systems & Components / Operating system package or component

postgresql16-server
Operating systems & Components / Operating system package or component

postgresql16-pltcl
Operating systems & Components / Operating system package or component

postgresql16-plperl
Operating systems & Components / Operating system package or component

postgresql17-server-devel
Operating systems & Components / Operating system package or component

postgresql17-plperl-debuginfo
Operating systems & Components / Operating system package or component

postgresql17-plperl
Operating systems & Components / Operating system package or component

postgresql17-pltcl-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-debuginfo
Operating systems & Components / Operating system package or component

postgresql17-devel-mini-debuginfo
Operating systems & Components / Operating system package or component

libpq5
Operating systems & Components / Operating system package or component

postgresql17-server
Operating systems & Components / Operating system package or component

postgresql16-plperl-debuginfo
Operating systems & Components / Operating system package or component

postgresql17-test
Operating systems & Components / Operating system package or component

postgresql16
Operating systems & Components / Operating system package or component

postgresql16-debugsource
Operating systems & Components / Operating system package or component

postgresql16-llvmjit-debuginfo
Operating systems & Components / Operating system package or component

postgresql17-plpython
Operating systems & Components / Operating system package or component

postgresql17-llvmjit
Operating systems & Components / Operating system package or component

postgresql16-llvmjit-devel
Operating systems & Components / Operating system package or component

postgresql16-server-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-contrib-debuginfo
Operating systems & Components / Operating system package or component

postgresql17-pltcl
Operating systems & Components / Operating system package or component

postgresql16-devel-debuginfo
Operating systems & Components / Operating system package or component

postgresql17-server-debuginfo
Operating systems & Components / Operating system package or component

postgresql17-llvmjit-devel
Operating systems & Components / Operating system package or component

postgresql17-contrib-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-plpython-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-server-devel-debuginfo
Operating systems & Components / Operating system package or component

libpq5-debuginfo
Operating systems & Components / Operating system package or component

postgresql17-devel-debuginfo
Operating systems & Components / Operating system package or component

postgresql17-debugsource
Operating systems & Components / Operating system package or component

postgresql16-contrib
Operating systems & Components / Operating system package or component

postgresql17-server-devel-debuginfo
Operating systems & Components / Operating system package or component

libecpg6
Operating systems & Components / Operating system package or component

postgresql17
Operating systems & Components / Operating system package or component

postgresql17-plpython-debuginfo
Operating systems & Components / Operating system package or component

libecpg6-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-llvmjit
Operating systems & Components / Operating system package or component

postgresql16-test
Operating systems & Components / Operating system package or component

postgresql17-llvmjit-debuginfo
Operating systems & Components / Operating system package or component

postgresql17-debuginfo
Operating systems & Components / Operating system package or component

postgresql16-plpython
Operating systems & Components / Operating system package or component

postgresql17-devel-mini
Operating systems & Components / Operating system package or component

postgresql-plperl
Operating systems & Components / Operating system package or component

postgresql-devel
Operating systems & Components / Operating system package or component

postgresql-test
Operating systems & Components / Operating system package or component

postgresql17-docs
Operating systems & Components / Operating system package or component

postgresql-pltcl
Operating systems & Components / Operating system package or component

postgresql-plpython
Operating systems & Components / Operating system package or component

postgresql
Operating systems & Components / Operating system package or component

postgresql-llvmjit
Operating systems & Components / Operating system package or component

postgresql16-docs
Operating systems & Components / Operating system package or component

postgresql-server
Operating systems & Components / Operating system package or component

postgresql-server-devel
Operating systems & Components / Operating system package or component

postgresql-contrib
Operating systems & Components / Operating system package or component

postgresql-llvmjit-devel
Operating systems & Components / Operating system package or component

postgresql-docs
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Improper privilege management

EUVDB-ID: #VU100511

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-10976

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to improper privilege management in cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. A remote user can bypass implemented security restrictions and gain unauthorized access to the database in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles.

Mitigation

Update the affected package postgresql, postgresql16, postgresql17 to the latest version.

Vulnerable software versions

SUSE Package Hub 15: 15-SP6

Server Applications Module: 15-SP6

Basesystem Module: 15-SP6

SUSE Linux Enterprise Real Time 15: SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

SUSE Linux Enterprise Desktop 15: SP6

libpq5-64bit: before 17.2-150600.13.5.1

libecpg6-64bit-debuginfo: before 17.2-150600.13.5.1

libpq5-64bit-debuginfo: before 17.2-150600.13.5.1

libecpg6-64bit: before 17.2-150600.13.5.1

libecpg6-32bit-debuginfo: before 17.2-150600.13.5.1

libpq5-32bit: before 17.2-150600.13.5.1

libpq5-32bit-debuginfo: before 17.2-150600.13.5.1

libecpg6-32bit: before 17.2-150600.13.5.1

postgresql16-server-devel: before 16.6-150600.16.10.1

postgresql17-contrib: before 17.2-150600.13.5.1

postgresql17-devel: before 17.2-150600.13.5.1

postgresql16-pltcl-debuginfo: before 16.6-150600.16.10.1

postgresql16-devel: before 16.6-150600.16.10.1

postgresql17-mini-debugsource: before 17.2-150600.13.5.1

postgresql16-server: before 16.6-150600.16.10.1

postgresql16-pltcl: before 16.6-150600.16.10.1

postgresql16-plperl: before 16.6-150600.16.10.1

postgresql17-server-devel: before 17.2-150600.13.5.1

postgresql17-plperl-debuginfo: before 17.2-150600.13.5.1

postgresql17-plperl: before 17.2-150600.13.5.1

postgresql17-pltcl-debuginfo: before 17.2-150600.13.5.1

postgresql16-debuginfo: before 16.6-150600.16.10.1

postgresql17-devel-mini-debuginfo: before 17.2-150600.13.5.1

libpq5: before 17.2-150600.13.5.1

postgresql17-server: before 17.2-150600.13.5.1

postgresql16-plperl-debuginfo: before 16.6-150600.16.10.1

postgresql17-test: before 17.2-150600.13.5.1

postgresql16: before 16.6-150600.16.10.1

postgresql16-debugsource: before 16.6-150600.16.10.1

postgresql16-llvmjit-debuginfo: before 16.6-150600.16.10.1

postgresql17-plpython: before 17.2-150600.13.5.1

postgresql17-llvmjit: before 17.2-150600.13.5.1

postgresql16-llvmjit-devel: before 16.6-150600.16.10.1

postgresql16-server-debuginfo: before 16.6-150600.16.10.1

postgresql16-contrib-debuginfo: before 16.6-150600.16.10.1

postgresql17-pltcl: before 17.2-150600.13.5.1

postgresql16-devel-debuginfo: before 16.6-150600.16.10.1

postgresql17-server-debuginfo: before 17.2-150600.13.5.1

postgresql17-llvmjit-devel: before 17.2-150600.13.5.1

postgresql17-contrib-debuginfo: before 17.2-150600.13.5.1

postgresql16-plpython-debuginfo: before 16.6-150600.16.10.1

postgresql16-server-devel-debuginfo: before 16.6-150600.16.10.1

libpq5-debuginfo: before 17.2-150600.13.5.1

postgresql17-devel-debuginfo: before 17.2-150600.13.5.1

postgresql17-debugsource: before 17.2-150600.13.5.1

postgresql16-contrib: before 16.6-150600.16.10.1

postgresql17-server-devel-debuginfo: before 17.2-150600.13.5.1

libecpg6: before 17.2-150600.13.5.1

postgresql17: before 17.2-150600.13.5.1

postgresql17-plpython-debuginfo: before 17.2-150600.13.5.1

libecpg6-debuginfo: before 17.2-150600.13.5.1

postgresql16-llvmjit: before 16.6-150600.16.10.1

postgresql16-test: before 16.6-150600.16.10.1

postgresql17-llvmjit-debuginfo: before 17.2-150600.13.5.1

postgresql17-debuginfo: before 17.2-150600.13.5.1

postgresql16-plpython: before 16.6-150600.16.10.1

postgresql17-devel-mini: before 17.2-150600.13.5.1

postgresql-plperl: before 17-150600.17.6.1

postgresql-devel: before 17-150600.17.6.1

postgresql-test: before 17-150600.17.6.1

postgresql17-docs: before 17.2-150600.13.5.1

postgresql-pltcl: before 17-150600.17.6.1

postgresql-plpython: before 17-150600.17.6.1

postgresql: before 17-150600.17.6.1

postgresql-llvmjit: before 17-150600.17.6.1

postgresql16-docs: before 16.6-150600.16.10.1

postgresql-server: before 17-150600.17.6.1

postgresql-server-devel: before 17-150600.17.6.1

postgresql-contrib: before 17-150600.17.6.1

postgresql-llvmjit-devel: before 17-150600.17.6.1

postgresql-docs: before 17-150600.17.6.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2024/suse-su-20244063-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Man-in-the-Middle (MitM) attack

EUVDB-ID: #VU100512

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-10977

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

Description

The vulnerability allows a remote attacker to spoof error messages from the database.

The vulnerability exists due to an error in libpq, which allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. A remote attacker can perform a man-in-the-middle attack to send a long error message that a human or screen-scraper user of psql mistakes for valid query results.

Mitigation

Update the affected package postgresql, postgresql16, postgresql17 to the latest version.

Vulnerable software versions

SUSE Package Hub 15: 15-SP6

Server Applications Module: 15-SP6

Basesystem Module: 15-SP6

SUSE Linux Enterprise Real Time 15: SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

SUSE Linux Enterprise Desktop 15: SP6

libpq5-64bit: before 17.2-150600.13.5.1

libecpg6-64bit-debuginfo: before 17.2-150600.13.5.1

libpq5-64bit-debuginfo: before 17.2-150600.13.5.1

libecpg6-64bit: before 17.2-150600.13.5.1

libecpg6-32bit-debuginfo: before 17.2-150600.13.5.1

libpq5-32bit: before 17.2-150600.13.5.1

libpq5-32bit-debuginfo: before 17.2-150600.13.5.1

libecpg6-32bit: before 17.2-150600.13.5.1

postgresql16-server-devel: before 16.6-150600.16.10.1

postgresql17-contrib: before 17.2-150600.13.5.1

postgresql17-devel: before 17.2-150600.13.5.1

postgresql16-pltcl-debuginfo: before 16.6-150600.16.10.1

postgresql16-devel: before 16.6-150600.16.10.1

postgresql17-mini-debugsource: before 17.2-150600.13.5.1

postgresql16-server: before 16.6-150600.16.10.1

postgresql16-pltcl: before 16.6-150600.16.10.1

postgresql16-plperl: before 16.6-150600.16.10.1

postgresql17-server-devel: before 17.2-150600.13.5.1

postgresql17-plperl-debuginfo: before 17.2-150600.13.5.1

postgresql17-plperl: before 17.2-150600.13.5.1

postgresql17-pltcl-debuginfo: before 17.2-150600.13.5.1

postgresql16-debuginfo: before 16.6-150600.16.10.1

postgresql17-devel-mini-debuginfo: before 17.2-150600.13.5.1

libpq5: before 17.2-150600.13.5.1

postgresql17-server: before 17.2-150600.13.5.1

postgresql16-plperl-debuginfo: before 16.6-150600.16.10.1

postgresql17-test: before 17.2-150600.13.5.1

postgresql16: before 16.6-150600.16.10.1

postgresql16-debugsource: before 16.6-150600.16.10.1

postgresql16-llvmjit-debuginfo: before 16.6-150600.16.10.1

postgresql17-plpython: before 17.2-150600.13.5.1

postgresql17-llvmjit: before 17.2-150600.13.5.1

postgresql16-llvmjit-devel: before 16.6-150600.16.10.1

postgresql16-server-debuginfo: before 16.6-150600.16.10.1

postgresql16-contrib-debuginfo: before 16.6-150600.16.10.1

postgresql17-pltcl: before 17.2-150600.13.5.1

postgresql16-devel-debuginfo: before 16.6-150600.16.10.1

postgresql17-server-debuginfo: before 17.2-150600.13.5.1

postgresql17-llvmjit-devel: before 17.2-150600.13.5.1

postgresql17-contrib-debuginfo: before 17.2-150600.13.5.1

postgresql16-plpython-debuginfo: before 16.6-150600.16.10.1

postgresql16-server-devel-debuginfo: before 16.6-150600.16.10.1

libpq5-debuginfo: before 17.2-150600.13.5.1

postgresql17-devel-debuginfo: before 17.2-150600.13.5.1

postgresql17-debugsource: before 17.2-150600.13.5.1

postgresql16-contrib: before 16.6-150600.16.10.1

postgresql17-server-devel-debuginfo: before 17.2-150600.13.5.1

libecpg6: before 17.2-150600.13.5.1

postgresql17: before 17.2-150600.13.5.1

postgresql17-plpython-debuginfo: before 17.2-150600.13.5.1

libecpg6-debuginfo: before 17.2-150600.13.5.1

postgresql16-llvmjit: before 16.6-150600.16.10.1

postgresql16-test: before 16.6-150600.16.10.1

postgresql17-llvmjit-debuginfo: before 17.2-150600.13.5.1

postgresql17-debuginfo: before 17.2-150600.13.5.1

postgresql16-plpython: before 16.6-150600.16.10.1

postgresql17-devel-mini: before 17.2-150600.13.5.1

postgresql-plperl: before 17-150600.17.6.1

postgresql-devel: before 17-150600.17.6.1

postgresql-test: before 17-150600.17.6.1

postgresql17-docs: before 17.2-150600.13.5.1

postgresql-pltcl: before 17-150600.17.6.1

postgresql-plpython: before 17-150600.17.6.1

postgresql: before 17-150600.17.6.1

postgresql-llvmjit: before 17-150600.17.6.1

postgresql16-docs: before 16.6-150600.16.10.1

postgresql-server: before 17-150600.17.6.1

postgresql-server-devel: before 17-150600.17.6.1

postgresql-contrib: before 17-150600.17.6.1

postgresql-llvmjit-devel: before 17-150600.17.6.1

postgresql-docs: before 17-150600.17.6.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2024/suse-su-20244063-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Incorrect privilege assignment

EUVDB-ID: #VU100513

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-10978

CWE-ID: CWE-266 - Incorrect Privilege Assignment

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to incorrect privilege assignment when application uses SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. A remote user can force the application to reset their role to a wrong user ID and view or change different rows from those intended.

Mitigation

Update the affected package postgresql, postgresql16, postgresql17 to the latest version.

Vulnerable software versions

SUSE Package Hub 15: 15-SP6

Server Applications Module: 15-SP6

Basesystem Module: 15-SP6

SUSE Linux Enterprise Real Time 15: SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

SUSE Linux Enterprise Desktop 15: SP6

libpq5-64bit: before 17.2-150600.13.5.1

libecpg6-64bit-debuginfo: before 17.2-150600.13.5.1

libpq5-64bit-debuginfo: before 17.2-150600.13.5.1

libecpg6-64bit: before 17.2-150600.13.5.1

libecpg6-32bit-debuginfo: before 17.2-150600.13.5.1

libpq5-32bit: before 17.2-150600.13.5.1

libpq5-32bit-debuginfo: before 17.2-150600.13.5.1

libecpg6-32bit: before 17.2-150600.13.5.1

postgresql16-server-devel: before 16.6-150600.16.10.1

postgresql17-contrib: before 17.2-150600.13.5.1

postgresql17-devel: before 17.2-150600.13.5.1

postgresql16-pltcl-debuginfo: before 16.6-150600.16.10.1

postgresql16-devel: before 16.6-150600.16.10.1

postgresql17-mini-debugsource: before 17.2-150600.13.5.1

postgresql16-server: before 16.6-150600.16.10.1

postgresql16-pltcl: before 16.6-150600.16.10.1

postgresql16-plperl: before 16.6-150600.16.10.1

postgresql17-server-devel: before 17.2-150600.13.5.1

postgresql17-plperl-debuginfo: before 17.2-150600.13.5.1

postgresql17-plperl: before 17.2-150600.13.5.1

postgresql17-pltcl-debuginfo: before 17.2-150600.13.5.1

postgresql16-debuginfo: before 16.6-150600.16.10.1

postgresql17-devel-mini-debuginfo: before 17.2-150600.13.5.1

libpq5: before 17.2-150600.13.5.1

postgresql17-server: before 17.2-150600.13.5.1

postgresql16-plperl-debuginfo: before 16.6-150600.16.10.1

postgresql17-test: before 17.2-150600.13.5.1

postgresql16: before 16.6-150600.16.10.1

postgresql16-debugsource: before 16.6-150600.16.10.1

postgresql16-llvmjit-debuginfo: before 16.6-150600.16.10.1

postgresql17-plpython: before 17.2-150600.13.5.1

postgresql17-llvmjit: before 17.2-150600.13.5.1

postgresql16-llvmjit-devel: before 16.6-150600.16.10.1

postgresql16-server-debuginfo: before 16.6-150600.16.10.1

postgresql16-contrib-debuginfo: before 16.6-150600.16.10.1

postgresql17-pltcl: before 17.2-150600.13.5.1

postgresql16-devel-debuginfo: before 16.6-150600.16.10.1

postgresql17-server-debuginfo: before 17.2-150600.13.5.1

postgresql17-llvmjit-devel: before 17.2-150600.13.5.1

postgresql17-contrib-debuginfo: before 17.2-150600.13.5.1

postgresql16-plpython-debuginfo: before 16.6-150600.16.10.1

postgresql16-server-devel-debuginfo: before 16.6-150600.16.10.1

libpq5-debuginfo: before 17.2-150600.13.5.1

postgresql17-devel-debuginfo: before 17.2-150600.13.5.1

postgresql17-debugsource: before 17.2-150600.13.5.1

postgresql16-contrib: before 16.6-150600.16.10.1

postgresql17-server-devel-debuginfo: before 17.2-150600.13.5.1

libecpg6: before 17.2-150600.13.5.1

postgresql17: before 17.2-150600.13.5.1

postgresql17-plpython-debuginfo: before 17.2-150600.13.5.1

libecpg6-debuginfo: before 17.2-150600.13.5.1

postgresql16-llvmjit: before 16.6-150600.16.10.1

postgresql16-test: before 16.6-150600.16.10.1

postgresql17-llvmjit-debuginfo: before 17.2-150600.13.5.1

postgresql17-debuginfo: before 17.2-150600.13.5.1

postgresql16-plpython: before 16.6-150600.16.10.1

postgresql17-devel-mini: before 17.2-150600.13.5.1

postgresql-plperl: before 17-150600.17.6.1

postgresql-devel: before 17-150600.17.6.1

postgresql-test: before 17-150600.17.6.1

postgresql17-docs: before 17.2-150600.13.5.1

postgresql-pltcl: before 17-150600.17.6.1

postgresql-plpython: before 17-150600.17.6.1

postgresql: before 17-150600.17.6.1

postgresql-llvmjit: before 17-150600.17.6.1

postgresql16-docs: before 16.6-150600.16.10.1

postgresql-server: before 17-150600.17.6.1

postgresql-server-devel: before 17-150600.17.6.1

postgresql-contrib: before 17-150600.17.6.1

postgresql-llvmjit-devel: before 17-150600.17.6.1

postgresql-docs: before 17-150600.17.6.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2024/suse-su-20244063-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper authorization

EUVDB-ID: #VU100514

Risk: High

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-10979

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to incorrect control of environment variables. A remote unprivileged database user can change sensitive process environment variables (e.g. PATH) and execute arbitrary code on the database server.

Mitigation

Update the affected package postgresql, postgresql16, postgresql17 to the latest version.

Vulnerable software versions

SUSE Package Hub 15: 15-SP6

Server Applications Module: 15-SP6

Basesystem Module: 15-SP6

SUSE Linux Enterprise Real Time 15: SP6

openSUSE Leap: 15.6

SUSE Linux Enterprise Server for SAP Applications 15: SP6

SUSE Linux Enterprise Server 15: SP6

SUSE Linux Enterprise Desktop 15: SP6

libpq5-64bit: before 17.2-150600.13.5.1

libecpg6-64bit-debuginfo: before 17.2-150600.13.5.1

libpq5-64bit-debuginfo: before 17.2-150600.13.5.1

libecpg6-64bit: before 17.2-150600.13.5.1

libecpg6-32bit-debuginfo: before 17.2-150600.13.5.1

libpq5-32bit: before 17.2-150600.13.5.1

libpq5-32bit-debuginfo: before 17.2-150600.13.5.1

libecpg6-32bit: before 17.2-150600.13.5.1

postgresql16-server-devel: before 16.6-150600.16.10.1

postgresql17-contrib: before 17.2-150600.13.5.1

postgresql17-devel: before 17.2-150600.13.5.1

postgresql16-pltcl-debuginfo: before 16.6-150600.16.10.1

postgresql16-devel: before 16.6-150600.16.10.1

postgresql17-mini-debugsource: before 17.2-150600.13.5.1

postgresql16-server: before 16.6-150600.16.10.1

postgresql16-pltcl: before 16.6-150600.16.10.1

postgresql16-plperl: before 16.6-150600.16.10.1

postgresql17-server-devel: before 17.2-150600.13.5.1

postgresql17-plperl-debuginfo: before 17.2-150600.13.5.1

postgresql17-plperl: before 17.2-150600.13.5.1

postgresql17-pltcl-debuginfo: before 17.2-150600.13.5.1

postgresql16-debuginfo: before 16.6-150600.16.10.1

postgresql17-devel-mini-debuginfo: before 17.2-150600.13.5.1

libpq5: before 17.2-150600.13.5.1

postgresql17-server: before 17.2-150600.13.5.1

postgresql16-plperl-debuginfo: before 16.6-150600.16.10.1

postgresql17-test: before 17.2-150600.13.5.1

postgresql16: before 16.6-150600.16.10.1

postgresql16-debugsource: before 16.6-150600.16.10.1

postgresql16-llvmjit-debuginfo: before 16.6-150600.16.10.1

postgresql17-plpython: before 17.2-150600.13.5.1

postgresql17-llvmjit: before 17.2-150600.13.5.1

postgresql16-llvmjit-devel: before 16.6-150600.16.10.1

postgresql16-server-debuginfo: before 16.6-150600.16.10.1

postgresql16-contrib-debuginfo: before 16.6-150600.16.10.1

postgresql17-pltcl: before 17.2-150600.13.5.1

postgresql16-devel-debuginfo: before 16.6-150600.16.10.1

postgresql17-server-debuginfo: before 17.2-150600.13.5.1

postgresql17-llvmjit-devel: before 17.2-150600.13.5.1

postgresql17-contrib-debuginfo: before 17.2-150600.13.5.1

postgresql16-plpython-debuginfo: before 16.6-150600.16.10.1

postgresql16-server-devel-debuginfo: before 16.6-150600.16.10.1

libpq5-debuginfo: before 17.2-150600.13.5.1

postgresql17-devel-debuginfo: before 17.2-150600.13.5.1

postgresql17-debugsource: before 17.2-150600.13.5.1

postgresql16-contrib: before 16.6-150600.16.10.1

postgresql17-server-devel-debuginfo: before 17.2-150600.13.5.1

libecpg6: before 17.2-150600.13.5.1

postgresql17: before 17.2-150600.13.5.1

postgresql17-plpython-debuginfo: before 17.2-150600.13.5.1

libecpg6-debuginfo: before 17.2-150600.13.5.1

postgresql16-llvmjit: before 16.6-150600.16.10.1

postgresql16-test: before 16.6-150600.16.10.1

postgresql17-llvmjit-debuginfo: before 17.2-150600.13.5.1

postgresql17-debuginfo: before 17.2-150600.13.5.1

postgresql16-plpython: before 16.6-150600.16.10.1

postgresql17-devel-mini: before 17.2-150600.13.5.1

postgresql-plperl: before 17-150600.17.6.1

postgresql-devel: before 17-150600.17.6.1

postgresql-test: before 17-150600.17.6.1

postgresql17-docs: before 17.2-150600.13.5.1

postgresql-pltcl: before 17-150600.17.6.1

postgresql-plpython: before 17-150600.17.6.1

postgresql: before 17-150600.17.6.1

postgresql-llvmjit: before 17-150600.17.6.1

postgresql16-docs: before 16.6-150600.16.10.1

postgresql-server: before 17-150600.17.6.1

postgresql-server-devel: before 17-150600.17.6.1

postgresql-contrib: before 17-150600.17.6.1

postgresql-llvmjit-devel: before 17-150600.17.6.1

postgresql-docs: before 17-150600.17.6.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2024/suse-su-20244063-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###