SUSE-SU-2012:1021-1: Security update for PostgreSQL

sle-security-updates at lists.suse.com sle-security-updates at lists.suse.com
Wed Aug 22 12:08:33 MDT 2012


   SUSE Security Update: Security update for PostgreSQL
______________________________________________________________________________

Announcement ID:    SUSE-SU-2012:1021-1
Rating:             low
References:         #760511 #765069 #766799 #767505 #770193 #773771 
                    #774616 #774617 #775399 #775402 #776523 #776524 
                    
Cross-References:   CVE-2012-2143 CVE-2012-2655 CVE-2012-3488
                    CVE-2012-3489
Affected Products:
                    SUSE Linux Enterprise Server 11 SP2
                    SUSE Linux Enterprise Server 11 SP1 for VMware
                    SUSE Linux Enterprise Server 11 SP1
                    SUSE Linux Enterprise Desktop 11 SP2
                    SUSE Linux Enterprise Desktop 11 SP1
______________________________________________________________________________

   An update that solves four vulnerabilities and has 8 fixes
   is now available. It includes one version update.

Description:


   This update provides PostgreSQL 8.3.20. As part of this
   update, the  packaging scheme has been changed to
   accomodate an optional parallel  installation of newer
   PostgreSQL versions.

   The changes in 8.3.20 are:

   *

   Prevent access to external files/URLs via XML entity
   references. xml_parse() would attempt to fetch external
   files or URLs as needed to resolve DTD and entity
   references in an XML value, thus allowing unprivileged
   database users to attempt to fetch data with the privileges
   of the database server (CVE-2012-3489, bnc#776524).

   *

   Prevent access to external files/URLs via
   "contrib/xml2"'s xslt_process(). libxslt offers the ability
   to read and write both files and URLs through stylesheet
   commands, thus allowing unprivileged database users to both
   read and write data with the privileges of the database
   server. Disable that through proper use of libxslt's
   security options. (CVE-2012-3488, bnc#776523). Also, remove
   xslt_process()'s ability to fetch documents and stylesheets
   from external files/URLs.

   *

   Fix incorrect password transformation in
   contrib/pgcrypto's DES crypt() function. If a password
   string contained the byte value 0x80, the remainder of the
   password was ignored, causing the password to be much
   weaker than it appeared. With this fix, the rest of the
   string is properly included in the DES hash. Any stored
   password values that are affected by this bug will thus no
   longer match, so the stored values may need to be updated.
   (CVE-2012-2143)

   *

   Ignore SECURITY DEFINER and SET attributes for a
   procedural language's call handler. Applying such
   attributes to a call handler could crash the server.
   (CVE-2012-2655)

   *

   Allow numeric timezone offsets in timestamp input to
   be up to 16 hours away from UTC. Some historical time zones
   have offsets larger than 15 hours, the previous limit. This
   could result in dumped data values being rejected during
   reload.

   *

   Fix timestamp conversion to cope when the given time
   is exactly the last DST transition time for the current
   timezone. This oversight has been there a long time, but
   was not noticed previously because most DST-using zones are
   presumed to have an indefinite sequence of future DST
   transitions.

   *

   Fix text to name and char to name casts to perform
   string truncation correctly in multibyte encodings.

   *

   Fix memory copying bug in to_tsquery().

   *

   Fix slow session startup when pg_attribute is very
   large. If pg_attribute exceeds one-fourth of
   shared_buffers, cache rebuilding code that is sometimes
   needed during session start would trigger the
   synchronized-scan logic, causing it to take many times
   longer than normal. The problem was particularly acute if
   many new sessions were starting at once.

   *

   Ensure sequential scans check for query cancel
   reasonably often. A scan encountering many consecutive
   pages that contain no live tuples would not respond to
   interrupts meanwhile.

   *

   Show whole-row variables safely when printing views
   or rules. Corner cases involving ambiguous names (that is,
   the name could be either a table or column name of the
   query) were printed in an ambiguous way, risking that the
   view or rule would be interpreted differently after dump
   and reload. Avoid the ambiguous case by attaching a no-op
   cast.

   *

   Ensure autovacuum worker processes perform stack
   depth checking properly. Previously, infinite recursion in
   a function invoked by auto-ANALYZE could crash worker
   processes.

   *

   Fix logging collector to not lose log coherency under
   high load. The collector previously could fail to
   reassemble large messages if it got too busy.

   *

   Fix logging collector to ensure it will restart file
   rotation after receiving SIGHUP.

   *

   Fix PL/pgSQL's GET DIAGNOSTICS command when the
   target is the function's first variable.

   *

   Fix several performance problems in pg_dump when the
   database contains many objects. pg_dump could get very slow
   if the database contained many schemas, or if many objects
   are in dependency loops, or if there are many owned
   sequences.

   *

   Fix contrib/dblink's dblink_exec() to not leak
   temporary database connections upon error.

   Security Issue references:

   * CVE-2012-2143
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2143
   >
   * CVE-2012-2655
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2655
   >
   * CVE-2012-3489
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3489
   >
   * CVE-2012-3488
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3488
   >


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 11 SP2:

      zypper in -t patch slessp1-postgresql-6697

   - SUSE Linux Enterprise Server 11 SP1 for VMware:

      zypper in -t patch slessp1-postgresql-6697

   - SUSE Linux Enterprise Server 11 SP1:

      zypper in -t patch slessp1-postgresql-6697

   - SUSE Linux Enterprise Desktop 11 SP2:

      zypper in -t patch sledsp1-postgresql-6697

   - SUSE Linux Enterprise Desktop 11 SP1:

      zypper in -t patch sledsp1-postgresql-6697

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 8.3.20]:

      postgresql-8.3.20-0.4.1
      postgresql-contrib-8.3.20-0.4.1
      postgresql-docs-8.3.20-0.4.1
      postgresql-server-8.3.20-0.4.1

   - SUSE Linux Enterprise Server 11 SP2 (noarch):

      postgresql-init-9.1-0.6.10.1

   - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64) [New Version: 8.3.20]:

      postgresql-8.3.20-0.4.1
      postgresql-contrib-8.3.20-0.4.1
      postgresql-docs-8.3.20-0.4.1
      postgresql-server-8.3.20-0.4.1

   - SUSE Linux Enterprise Server 11 SP1 for VMware (noarch):

      postgresql-init-9.1-0.6.10.1

   - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 8.3.20]:

      postgresql-8.3.20-0.4.1
      postgresql-contrib-8.3.20-0.4.1
      postgresql-docs-8.3.20-0.4.1
      postgresql-server-8.3.20-0.4.1

   - SUSE Linux Enterprise Server 11 SP1 (noarch):

      postgresql-init-9.1-0.6.10.1

   - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 8.3.20]:

      postgresql-8.3.20-0.4.1

   - SUSE Linux Enterprise Desktop 11 SP2 (noarch):

      postgresql-init-9.1-0.6.10.1

   - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 8.3.20]:

      postgresql-8.3.20-0.4.1

   - SUSE Linux Enterprise Desktop 11 SP1 (noarch):

      postgresql-init-9.1-0.6.10.1


References:

   http://support.novell.com/security/cve/CVE-2012-2143.html
   http://support.novell.com/security/cve/CVE-2012-2655.html
   http://support.novell.com/security/cve/CVE-2012-3488.html
   http://support.novell.com/security/cve/CVE-2012-3489.html
   https://bugzilla.novell.com/760511
   https://bugzilla.novell.com/765069
   https://bugzilla.novell.com/766799
   https://bugzilla.novell.com/767505
   https://bugzilla.novell.com/770193
   https://bugzilla.novell.com/773771
   https://bugzilla.novell.com/774616
   https://bugzilla.novell.com/774617
   https://bugzilla.novell.com/775399
   https://bugzilla.novell.com/775402
   https://bugzilla.novell.com/776523
   https://bugzilla.novell.com/776524
   http://download.novell.com/patch/finder/?keywords=a40b143814a37b566fd7889125c16b7d



More information about the sle-security-updates mailing list