Security update for postgresql15 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3384-1 Final 1 1 2023-08-23T08:19:48Z current 2023-08-23T08:19:48Z 2023-08-23T08:19:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postgresql15 This update for postgresql15 fixes the following issues: - Update to 12.16 - CVE-2023-39417: Fixed potential SQL injection for trusted extensions. (bsc#1214059) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-3384,openSUSE-SLE-15.4-2023-3384,openSUSE-SLE-15.5-2023-3384 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233384-1/ Link for SUSE-SU-2023:3384-1 https://lists.suse.com/pipermail/sle-security-updates/2023-August/015996.html E-Mail link for SUSE-SU-2023:3384-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1214059 SUSE Bug 1214059 https://www.suse.com/security/cve/CVE-2023-39417/ SUSE CVE CVE-2023-39417 page openSUSE Leap 15.4 openSUSE Leap 15.5 postgresql12-12.16-150200.8.47.1 postgresql12-contrib-12.16-150200.8.47.1 postgresql12-devel-12.16-150200.8.47.1 postgresql12-docs-12.16-150200.8.47.1 postgresql12-llvmjit-12.16-150200.8.47.1 postgresql12-llvmjit-devel-12.16-150200.8.47.1 postgresql12-plperl-12.16-150200.8.47.1 postgresql12-plpython-12.16-150200.8.47.1 postgresql12-pltcl-12.16-150200.8.47.1 postgresql12-server-12.16-150200.8.47.1 postgresql12-server-devel-12.16-150200.8.47.1 postgresql12-test-12.16-150200.8.47.1 postgresql12-12.16-150200.8.47.1 as a component of openSUSE Leap 15.4 postgresql12-contrib-12.16-150200.8.47.1 as a component of openSUSE Leap 15.4 postgresql12-devel-12.16-150200.8.47.1 as a component of openSUSE Leap 15.4 postgresql12-docs-12.16-150200.8.47.1 as a component of openSUSE Leap 15.4 postgresql12-llvmjit-12.16-150200.8.47.1 as a component of openSUSE Leap 15.4 postgresql12-llvmjit-devel-12.16-150200.8.47.1 as a component of openSUSE Leap 15.4 postgresql12-plperl-12.16-150200.8.47.1 as a component of openSUSE Leap 15.4 postgresql12-plpython-12.16-150200.8.47.1 as a component of openSUSE Leap 15.4 postgresql12-pltcl-12.16-150200.8.47.1 as a component of openSUSE Leap 15.4 postgresql12-server-12.16-150200.8.47.1 as a component of openSUSE Leap 15.4 postgresql12-server-devel-12.16-150200.8.47.1 as a component of openSUSE Leap 15.4 postgresql12-test-12.16-150200.8.47.1 as a component of openSUSE Leap 15.4 postgresql12-12.16-150200.8.47.1 as a component of openSUSE Leap 15.5 postgresql12-contrib-12.16-150200.8.47.1 as a component of openSUSE Leap 15.5 postgresql12-devel-12.16-150200.8.47.1 as a component of openSUSE Leap 15.5 postgresql12-docs-12.16-150200.8.47.1 as a component of openSUSE Leap 15.5 postgresql12-llvmjit-12.16-150200.8.47.1 as a component of openSUSE Leap 15.5 postgresql12-llvmjit-devel-12.16-150200.8.47.1 as a component of openSUSE Leap 15.5 postgresql12-plperl-12.16-150200.8.47.1 as a component of openSUSE Leap 15.5 postgresql12-plpython-12.16-150200.8.47.1 as a component of openSUSE Leap 15.5 postgresql12-pltcl-12.16-150200.8.47.1 as a component of openSUSE Leap 15.5 postgresql12-server-12.16-150200.8.47.1 as a component of openSUSE Leap 15.5 postgresql12-server-devel-12.16-150200.8.47.1 as a component of openSUSE Leap 15.5 postgresql12-test-12.16-150200.8.47.1 as a component of openSUSE Leap 15.5 IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. CVE-2023-39417 openSUSE Leap 15.4:postgresql12-12.16-150200.8.47.1 openSUSE Leap 15.4:postgresql12-contrib-12.16-150200.8.47.1 openSUSE Leap 15.4:postgresql12-devel-12.16-150200.8.47.1 openSUSE Leap 15.4:postgresql12-docs-12.16-150200.8.47.1 openSUSE Leap 15.4:postgresql12-llvmjit-12.16-150200.8.47.1 openSUSE Leap 15.4:postgresql12-llvmjit-devel-12.16-150200.8.47.1 openSUSE Leap 15.4:postgresql12-plperl-12.16-150200.8.47.1 openSUSE Leap 15.4:postgresql12-plpython-12.16-150200.8.47.1 openSUSE Leap 15.4:postgresql12-pltcl-12.16-150200.8.47.1 openSUSE Leap 15.4:postgresql12-server-12.16-150200.8.47.1 openSUSE Leap 15.4:postgresql12-server-devel-12.16-150200.8.47.1 openSUSE Leap 15.4:postgresql12-test-12.16-150200.8.47.1 openSUSE Leap 15.5:postgresql12-12.16-150200.8.47.1 openSUSE Leap 15.5:postgresql12-contrib-12.16-150200.8.47.1 openSUSE Leap 15.5:postgresql12-devel-12.16-150200.8.47.1 openSUSE Leap 15.5:postgresql12-docs-12.16-150200.8.47.1 openSUSE Leap 15.5:postgresql12-llvmjit-12.16-150200.8.47.1 openSUSE Leap 15.5:postgresql12-llvmjit-devel-12.16-150200.8.47.1 openSUSE Leap 15.5:postgresql12-plperl-12.16-150200.8.47.1 openSUSE Leap 15.5:postgresql12-plpython-12.16-150200.8.47.1 openSUSE Leap 15.5:postgresql12-pltcl-12.16-150200.8.47.1 openSUSE Leap 15.5:postgresql12-server-12.16-150200.8.47.1 openSUSE Leap 15.5:postgresql12-server-devel-12.16-150200.8.47.1 openSUSE Leap 15.5:postgresql12-test-12.16-150200.8.47.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233384-1/ https://www.suse.com/security/cve/CVE-2023-39417.html CVE-2023-39417 https://bugzilla.suse.com/1214059 SUSE Bug 1214059