SUSE update for postgresql15
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 4 |
| CVE-ID | CVE-2024-10976 CVE-2024-10977 CVE-2024-10978 CVE-2024-10979 |
| CWE-ID | CWE-269 CWE-300 CWE-266 CWE-285 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
SUSE Linux Enterprise Server 15 SP3 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 SP4 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop 15 SP4 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing LTSS 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing ESPOS 15 Operating systems & Components / Operating system Server Applications Module Operating systems & Components / Operating system Basesystem Module Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop 15 Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system SUSE Manager Retail Branch Server Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Manager Proxy Operating systems & Components / Operating system postgresql15-docs Operating systems & Components / Operating system package or component postgresql15-debugsource Operating systems & Components / Operating system package or component postgresql15-llvmjit Operating systems & Components / Operating system package or component postgresql15-server-devel-debuginfo Operating systems & Components / Operating system package or component postgresql15-plperl-debuginfo Operating systems & Components / Operating system package or component postgresql15 Operating systems & Components / Operating system package or component postgresql15-contrib-debuginfo Operating systems & Components / Operating system package or component postgresql15-server Operating systems & Components / Operating system package or component postgresql15-pltcl-debuginfo Operating systems & Components / Operating system package or component postgresql15-contrib Operating systems & Components / Operating system package or component postgresql15-pltcl Operating systems & Components / Operating system package or component postgresql15-server-debuginfo Operating systems & Components / Operating system package or component postgresql15-server-devel Operating systems & Components / Operating system package or component postgresql15-devel Operating systems & Components / Operating system package or component postgresql15-devel-debuginfo Operating systems & Components / Operating system package or component postgresql15-test Operating systems & Components / Operating system package or component postgresql15-llvmjit-debuginfo Operating systems & Components / Operating system package or component postgresql15-debuginfo Operating systems & Components / Operating system package or component postgresql15-plperl Operating systems & Components / Operating system package or component postgresql15-llvmjit-devel Operating systems & Components / Operating system package or component postgresql15-plpython Operating systems & Components / Operating system package or component postgresql15-plpython-debuginfo Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
1) Improper privilege management
EUVDB-ID: #VU100511
Risk: Medium
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-10976
CWE-ID:
CWE-269 - Improper Privilege Management
Exploit availability: No
DescriptionThe vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to improper privilege management in cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. A remote user can bypass implemented security restrictions and gain unauthorized access to the database in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles.
MitigationUpdate the affected package postgresql15 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
SUSE Linux Enterprise Desktop 15 SP4: LTSS
SUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP4
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4
Server Applications Module: 15-SP5
Basesystem Module: 15-SP5
SUSE Linux Enterprise Server for SAP Applications 15: SP3 - SP5
SUSE Linux Enterprise Server 15: SP3 - SP5
SUSE Linux Enterprise Real Time 15: SP5
SUSE Linux Enterprise High Performance Computing 15: SP3 - SP5
SUSE Linux Enterprise Desktop 15: SP5
openSUSE Leap: 15.5
SUSE Enterprise Storage: 7.1
SUSE Manager Retail Branch Server: 4.3
SUSE Manager Server: 4.3
SUSE Manager Proxy: 4.3
postgresql15-docs: before 15.10-150200.5.33.1
postgresql15-debugsource: before 15.10-150200.5.33.1
postgresql15-llvmjit: before 15.10-150200.5.33.1
postgresql15-server-devel-debuginfo: before 15.10-150200.5.33.1
postgresql15-plperl-debuginfo: before 15.10-150200.5.33.1
postgresql15: before 15.10-150200.5.33.1
postgresql15-contrib-debuginfo: before 15.10-150200.5.33.1
postgresql15-server: before 15.10-150200.5.33.1
postgresql15-pltcl-debuginfo: before 15.10-150200.5.33.1
postgresql15-contrib: before 15.10-150200.5.33.1
postgresql15-pltcl: before 15.10-150200.5.33.1
postgresql15-server-debuginfo: before 15.10-150200.5.33.1
postgresql15-server-devel: before 15.10-150200.5.33.1
postgresql15-devel: before 15.10-150200.5.33.1
postgresql15-devel-debuginfo: before 15.10-150200.5.33.1
postgresql15-test: before 15.10-150200.5.33.1
postgresql15-llvmjit-debuginfo: before 15.10-150200.5.33.1
postgresql15-debuginfo: before 15.10-150200.5.33.1
postgresql15-plperl: before 15.10-150200.5.33.1
postgresql15-llvmjit-devel: before 15.10-150200.5.33.1
postgresql15-plpython: before 15.10-150200.5.33.1
postgresql15-plpython-debuginfo: before 15.10-150200.5.33.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:server_applications_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_proxy:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:postgresql15-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plperl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-contrib-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-pltcl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-llvmjit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plpython-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2024/suse-su-20244174-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Man-in-the-Middle (MitM) attack
EUVDB-ID: #VU100512
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-10977
CWE-ID:
CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to spoof error messages from the database.
The vulnerability exists due to an error in libpq, which allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. A remote attacker can perform a man-in-the-middle attack to send a long error message that a human or screen-scraper user of psql mistakes for valid query results.
MitigationUpdate the affected package postgresql15 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
SUSE Linux Enterprise Desktop 15 SP4: LTSS
SUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP4
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4
Server Applications Module: 15-SP5
Basesystem Module: 15-SP5
SUSE Linux Enterprise Server for SAP Applications 15: SP3 - SP5
SUSE Linux Enterprise Server 15: SP3 - SP5
SUSE Linux Enterprise Real Time 15: SP5
SUSE Linux Enterprise High Performance Computing 15: SP3 - SP5
SUSE Linux Enterprise Desktop 15: SP5
openSUSE Leap: 15.5
SUSE Enterprise Storage: 7.1
SUSE Manager Retail Branch Server: 4.3
SUSE Manager Server: 4.3
SUSE Manager Proxy: 4.3
postgresql15-docs: before 15.10-150200.5.33.1
postgresql15-debugsource: before 15.10-150200.5.33.1
postgresql15-llvmjit: before 15.10-150200.5.33.1
postgresql15-server-devel-debuginfo: before 15.10-150200.5.33.1
postgresql15-plperl-debuginfo: before 15.10-150200.5.33.1
postgresql15: before 15.10-150200.5.33.1
postgresql15-contrib-debuginfo: before 15.10-150200.5.33.1
postgresql15-server: before 15.10-150200.5.33.1
postgresql15-pltcl-debuginfo: before 15.10-150200.5.33.1
postgresql15-contrib: before 15.10-150200.5.33.1
postgresql15-pltcl: before 15.10-150200.5.33.1
postgresql15-server-debuginfo: before 15.10-150200.5.33.1
postgresql15-server-devel: before 15.10-150200.5.33.1
postgresql15-devel: before 15.10-150200.5.33.1
postgresql15-devel-debuginfo: before 15.10-150200.5.33.1
postgresql15-test: before 15.10-150200.5.33.1
postgresql15-llvmjit-debuginfo: before 15.10-150200.5.33.1
postgresql15-debuginfo: before 15.10-150200.5.33.1
postgresql15-plperl: before 15.10-150200.5.33.1
postgresql15-llvmjit-devel: before 15.10-150200.5.33.1
postgresql15-plpython: before 15.10-150200.5.33.1
postgresql15-plpython-debuginfo: before 15.10-150200.5.33.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:server_applications_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_proxy:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:postgresql15-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plperl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-contrib-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-pltcl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-llvmjit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plpython-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2024/suse-su-20244174-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Incorrect privilege assignment
EUVDB-ID: #VU100513
Risk: Medium
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-10978
CWE-ID:
CWE-266 - Incorrect Privilege Assignment
Exploit availability: No
DescriptionThe vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to incorrect privilege assignment when application uses SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. A remote user can force the application to reset their role to a wrong user ID and view or change different rows from those intended.
MitigationUpdate the affected package postgresql15 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
SUSE Linux Enterprise Desktop 15 SP4: LTSS
SUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP4
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4
Server Applications Module: 15-SP5
Basesystem Module: 15-SP5
SUSE Linux Enterprise Server for SAP Applications 15: SP3 - SP5
SUSE Linux Enterprise Server 15: SP3 - SP5
SUSE Linux Enterprise Real Time 15: SP5
SUSE Linux Enterprise High Performance Computing 15: SP3 - SP5
SUSE Linux Enterprise Desktop 15: SP5
openSUSE Leap: 15.5
SUSE Enterprise Storage: 7.1
SUSE Manager Retail Branch Server: 4.3
SUSE Manager Server: 4.3
SUSE Manager Proxy: 4.3
postgresql15-docs: before 15.10-150200.5.33.1
postgresql15-debugsource: before 15.10-150200.5.33.1
postgresql15-llvmjit: before 15.10-150200.5.33.1
postgresql15-server-devel-debuginfo: before 15.10-150200.5.33.1
postgresql15-plperl-debuginfo: before 15.10-150200.5.33.1
postgresql15: before 15.10-150200.5.33.1
postgresql15-contrib-debuginfo: before 15.10-150200.5.33.1
postgresql15-server: before 15.10-150200.5.33.1
postgresql15-pltcl-debuginfo: before 15.10-150200.5.33.1
postgresql15-contrib: before 15.10-150200.5.33.1
postgresql15-pltcl: before 15.10-150200.5.33.1
postgresql15-server-debuginfo: before 15.10-150200.5.33.1
postgresql15-server-devel: before 15.10-150200.5.33.1
postgresql15-devel: before 15.10-150200.5.33.1
postgresql15-devel-debuginfo: before 15.10-150200.5.33.1
postgresql15-test: before 15.10-150200.5.33.1
postgresql15-llvmjit-debuginfo: before 15.10-150200.5.33.1
postgresql15-debuginfo: before 15.10-150200.5.33.1
postgresql15-plperl: before 15.10-150200.5.33.1
postgresql15-llvmjit-devel: before 15.10-150200.5.33.1
postgresql15-plpython: before 15.10-150200.5.33.1
postgresql15-plpython-debuginfo: before 15.10-150200.5.33.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:server_applications_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_proxy:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:postgresql15-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plperl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-contrib-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-pltcl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-llvmjit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plpython-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2024/suse-su-20244174-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Improper authorization
EUVDB-ID: #VU100514
Risk: High
CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-10979
CWE-ID:
CWE-285 - Improper Authorization
Exploit availability: No
DescriptionThe vulnerability allows a remote user to compromise the affected system.
The vulnerability exists due to incorrect control of environment variables. A remote unprivileged database user can change sensitive process environment variables (e.g. PATH) and execute arbitrary code on the database server.
Update the affected package postgresql15 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
SUSE Linux Enterprise Desktop 15 SP4: LTSS
SUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP4
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4
Server Applications Module: 15-SP5
Basesystem Module: 15-SP5
SUSE Linux Enterprise Server for SAP Applications 15: SP3 - SP5
SUSE Linux Enterprise Server 15: SP3 - SP5
SUSE Linux Enterprise Real Time 15: SP5
SUSE Linux Enterprise High Performance Computing 15: SP3 - SP5
SUSE Linux Enterprise Desktop 15: SP5
openSUSE Leap: 15.5
SUSE Enterprise Storage: 7.1
SUSE Manager Retail Branch Server: 4.3
SUSE Manager Server: 4.3
SUSE Manager Proxy: 4.3
postgresql15-docs: before 15.10-150200.5.33.1
postgresql15-debugsource: before 15.10-150200.5.33.1
postgresql15-llvmjit: before 15.10-150200.5.33.1
postgresql15-server-devel-debuginfo: before 15.10-150200.5.33.1
postgresql15-plperl-debuginfo: before 15.10-150200.5.33.1
postgresql15: before 15.10-150200.5.33.1
postgresql15-contrib-debuginfo: before 15.10-150200.5.33.1
postgresql15-server: before 15.10-150200.5.33.1
postgresql15-pltcl-debuginfo: before 15.10-150200.5.33.1
postgresql15-contrib: before 15.10-150200.5.33.1
postgresql15-pltcl: before 15.10-150200.5.33.1
postgresql15-server-debuginfo: before 15.10-150200.5.33.1
postgresql15-server-devel: before 15.10-150200.5.33.1
postgresql15-devel: before 15.10-150200.5.33.1
postgresql15-devel-debuginfo: before 15.10-150200.5.33.1
postgresql15-test: before 15.10-150200.5.33.1
postgresql15-llvmjit-debuginfo: before 15.10-150200.5.33.1
postgresql15-debuginfo: before 15.10-150200.5.33.1
postgresql15-plperl: before 15.10-150200.5.33.1
postgresql15-llvmjit-devel: before 15.10-150200.5.33.1
postgresql15-plpython: before 15.10-150200.5.33.1
postgresql15-plpython-debuginfo: before 15.10-150200.5.33.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:server_applications_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_proxy:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:postgresql15-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-llvmjit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plperl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-contrib-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-pltcl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-contrib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-pltcl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-server-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-llvmjit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plperl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-llvmjit-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plpython:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:postgresql15-plpython-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2024/suse-su-20244174-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
