SUSE-SU-2026:20194-1: important: Security update for postgresql17 and postgresql18
SLE-UPDATES
null at suse.de
Tue Feb 3 16:30:55 UTC 2026
# Security update for postgresql17 and postgresql18
Announcement ID: SUSE-SU-2026:20194-1
Release Date: 2026-01-29T13:21:20Z
Rating: important
References:
* bsc#1253332
* bsc#1253333
Cross-References:
* CVE-2025-12817
* CVE-2025-12818
CVSS scores:
* CVE-2025-12817 ( SUSE ): 5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2025-12817 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
* CVE-2025-12817 ( NVD ): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-12818 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-12818 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-12818 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* SUSE Linux Enterprise Server 16.0
* SUSE Linux Enterprise Server for SAP Applications 16.0
An update that solves two vulnerabilities can now be installed.
## Description:
This update for postgresql17 and postgresql18 fixes the following issues:
Changes in postgresql17, postgresql18:
Update to 17.7:
* https://www.postgresql.org/about/news/p-3171/
* https://www.postgresql.org/docs/release/17.7/
* bsc#1253332, CVE-2025-12817: Missing check for CREATE privileges on the
schema in CREATE STATISTICS allowed table owners to create statistics in any
schema, potentially leading to unexpected naming conflicts.
* bsc#1253333, CVE-2025-12818: Several places in libpq were not sufficiently
careful about computing the required size of a memory allocation.
Sufficiently large inputs could cause integer overflow, resulting in an
undersized buffer, which would then lead to writing past the end of the
buffer.
Postgresql is shipped in version 18.1.
pgvector was updated to 0.8.1 to support postgresql18.
pgaudit was updated to support postgresql18.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server 16.0
zypper in -t patch SUSE-SLES-16.0-216=1
* SUSE Linux Enterprise Server for SAP Applications 16.0
zypper in -t patch SUSE-SLES-16.0-216=1
## Package List:
* SUSE Linux Enterprise Server 16.0 (noarch)
* postgresql18-docs-18.1-160000.1.1
* postgresql-plperl-18-160000.1.1
* postgresql-pltcl-18-160000.1.1
* postgresql-server-18-160000.1.1
* postgresql17-docs-17.7-160000.1.1
* postgresql-contrib-18-160000.1.1
* postgresql-server-devel-18-160000.1.1
* postgresql-plpython-18-160000.1.1
* postgresql-docs-18-160000.1.1
* postgresql-18-160000.1.1
* postgresql-devel-18-160000.1.1
* SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64)
* libecpg6-debuginfo-18.1-160000.1.1
* postgresql15-pgaudit-debugsource-1.7.1-160000.3.1
* postgresql15-pgvector-debugsource-0.8.1-160000.1.1
* postgresql18-pgaudit-18.0-160000.3.1
* postgresql13-pgvector-debuginfo-0.8.1-160000.1.1
* postgresql18-debugsource-18.1-160000.1.1
* postgresql18-plperl-debuginfo-18.1-160000.1.1
* postgresql14-pgaudit-debugsource-1.6.3-160000.3.1
* postgresql18-pgvector-0.8.1-160000.1.1
* postgresql18-pgvector-debugsource-0.8.1-160000.1.1
* postgresql17-pgaudit-debugsource-17.1-160000.3.1
* postgresql17-plperl-debuginfo-17.7-160000.1.1
* postgresql17-contrib-debuginfo-17.7-160000.1.1
* postgresql18-server-devel-18.1-160000.1.1
* postgresql14-pgaudit-1.6.3-160000.3.1
* postgresql18-pltcl-debuginfo-18.1-160000.1.1
* postgresql18-server-18.1-160000.1.1
* postgresql17-debuginfo-17.7-160000.1.1
* libpq5-18.1-160000.1.1
* postgresql17-plpython-debuginfo-17.7-160000.1.1
* postgresql18-server-debuginfo-18.1-160000.1.1
* postgresql18-devel-18.1-160000.1.1
* postgresql17-17.7-160000.1.1
* postgresql17-devel-17.7-160000.1.1
* postgresql16-pgvector-debugsource-0.8.1-160000.1.1
* postgresql17-server-devel-17.7-160000.1.1
* postgresql18-pgvector-debuginfo-0.8.1-160000.1.1
* postgresql16-pgvector-debuginfo-0.8.1-160000.1.1
* postgresql17-pgvector-debugsource-0.8.1-160000.1.1
* postgresql17-server-devel-debuginfo-17.7-160000.1.1
* postgresql17-debugsource-17.7-160000.1.1
* postgresql18-pltcl-18.1-160000.1.1
* postgresql13-pgvector-debugsource-0.8.1-160000.1.1
* postgresql18-server-devel-debuginfo-18.1-160000.1.1
* postgresql15-pgaudit-debuginfo-1.7.1-160000.3.1
* libecpg6-18.1-160000.1.1
* postgresql18-plpython-debuginfo-18.1-160000.1.1
* postgresql13-pgaudit-debuginfo-1.5.3-160000.3.1
* postgresql17-plperl-17.7-160000.1.1
* postgresql18-pgaudit-debuginfo-18.0-160000.3.1
* postgresql14-pgvector-0.8.1-160000.1.1
* postgresql17-devel-debuginfo-17.7-160000.1.1
* postgresql17-server-17.7-160000.1.1
* postgresql18-devel-debuginfo-18.1-160000.1.1
* postgresql18-plperl-18.1-160000.1.1
* postgresql17-pltcl-debuginfo-17.7-160000.1.1
* postgresql14-pgvector-debugsource-0.8.1-160000.1.1
* postgresql17-pgvector-debuginfo-0.8.1-160000.1.1
* postgresql16-pgaudit-debugsource-16.1-160000.3.1
* postgresql13-pgvector-0.8.1-160000.1.1
* postgresql18-pgaudit-debugsource-18.0-160000.3.1
* postgresql15-pgaudit-1.7.1-160000.3.1
* postgresql15-pgvector-debuginfo-0.8.1-160000.1.1
* postgresql17-pltcl-17.7-160000.1.1
* postgresql17-server-debuginfo-17.7-160000.1.1
* postgresql14-pgaudit-debuginfo-1.6.3-160000.3.1
* postgresql16-pgaudit-debuginfo-16.1-160000.3.1
* postgresql17-pgaudit-debuginfo-17.1-160000.3.1
* postgresql16-pgaudit-16.1-160000.3.1
* postgresql18-debuginfo-18.1-160000.1.1
* postgresql18-contrib-18.1-160000.1.1
* postgresql15-pgvector-0.8.1-160000.1.1
* postgresql17-pgvector-0.8.1-160000.1.1
* postgresql18-18.1-160000.1.1
* postgresql18-contrib-debuginfo-18.1-160000.1.1
* postgresql16-pgvector-0.8.1-160000.1.1
* postgresql17-pgaudit-17.1-160000.3.1
* postgresql14-pgvector-debuginfo-0.8.1-160000.1.1
* libpq5-debuginfo-18.1-160000.1.1
* postgresql13-pgaudit-1.5.3-160000.3.1
* postgresql17-plpython-17.7-160000.1.1
* postgresql18-plpython-18.1-160000.1.1
* postgresql13-pgaudit-debugsource-1.5.3-160000.3.1
* postgresql17-contrib-17.7-160000.1.1
* SUSE Linux Enterprise Server for SAP Applications 16.0 (ppc64le x86_64)
* libecpg6-debuginfo-18.1-160000.1.1
* postgresql15-pgaudit-debugsource-1.7.1-160000.3.1
* postgresql15-pgvector-debugsource-0.8.1-160000.1.1
* postgresql18-pgaudit-18.0-160000.3.1
* postgresql13-pgvector-debuginfo-0.8.1-160000.1.1
* postgresql18-debugsource-18.1-160000.1.1
* postgresql18-plperl-debuginfo-18.1-160000.1.1
* postgresql14-pgaudit-debugsource-1.6.3-160000.3.1
* postgresql18-pgvector-0.8.1-160000.1.1
* postgresql18-pgvector-debugsource-0.8.1-160000.1.1
* postgresql17-pgaudit-debugsource-17.1-160000.3.1
* postgresql17-plperl-debuginfo-17.7-160000.1.1
* postgresql17-contrib-debuginfo-17.7-160000.1.1
* postgresql18-server-devel-18.1-160000.1.1
* postgresql14-pgaudit-1.6.3-160000.3.1
* postgresql18-pltcl-debuginfo-18.1-160000.1.1
* postgresql18-server-18.1-160000.1.1
* postgresql17-debuginfo-17.7-160000.1.1
* libpq5-18.1-160000.1.1
* postgresql17-plpython-debuginfo-17.7-160000.1.1
* postgresql18-server-debuginfo-18.1-160000.1.1
* postgresql18-devel-18.1-160000.1.1
* postgresql17-17.7-160000.1.1
* postgresql17-devel-17.7-160000.1.1
* postgresql16-pgvector-debugsource-0.8.1-160000.1.1
* postgresql17-server-devel-17.7-160000.1.1
* postgresql13-pgaudit-debugsource-1.5.3-160000.3.1
* postgresql18-pgvector-debuginfo-0.8.1-160000.1.1
* postgresql16-pgvector-debuginfo-0.8.1-160000.1.1
* postgresql17-pgvector-debugsource-0.8.1-160000.1.1
* postgresql17-server-devel-debuginfo-17.7-160000.1.1
* postgresql17-debugsource-17.7-160000.1.1
* postgresql18-pltcl-18.1-160000.1.1
* postgresql13-pgvector-debugsource-0.8.1-160000.1.1
* postgresql18-server-devel-debuginfo-18.1-160000.1.1
* postgresql15-pgaudit-debuginfo-1.7.1-160000.3.1
* libecpg6-18.1-160000.1.1
* postgresql18-plpython-debuginfo-18.1-160000.1.1
* postgresql13-pgaudit-debuginfo-1.5.3-160000.3.1
* postgresql17-plperl-17.7-160000.1.1
* postgresql18-pgaudit-debuginfo-18.0-160000.3.1
* postgresql14-pgvector-0.8.1-160000.1.1
* postgresql17-devel-debuginfo-17.7-160000.1.1
* postgresql17-server-17.7-160000.1.1
* postgresql18-devel-debuginfo-18.1-160000.1.1
* postgresql18-plperl-18.1-160000.1.1
* postgresql17-pltcl-debuginfo-17.7-160000.1.1
* postgresql14-pgvector-debugsource-0.8.1-160000.1.1
* postgresql17-pgvector-debuginfo-0.8.1-160000.1.1
* postgresql16-pgaudit-debugsource-16.1-160000.3.1
* postgresql18-pgaudit-debugsource-18.0-160000.3.1
* postgresql15-pgaudit-1.7.1-160000.3.1
* postgresql15-pgvector-debuginfo-0.8.1-160000.1.1
* postgresql17-pltcl-17.7-160000.1.1
* postgresql17-server-debuginfo-17.7-160000.1.1
* postgresql14-pgaudit-debuginfo-1.6.3-160000.3.1
* postgresql16-pgaudit-debuginfo-16.1-160000.3.1
* postgresql17-pgaudit-debuginfo-17.1-160000.3.1
* postgresql16-pgaudit-16.1-160000.3.1
* postgresql18-debuginfo-18.1-160000.1.1
* postgresql18-contrib-18.1-160000.1.1
* postgresql15-pgvector-0.8.1-160000.1.1
* postgresql17-pgvector-0.8.1-160000.1.1
* postgresql18-18.1-160000.1.1
* postgresql18-contrib-debuginfo-18.1-160000.1.1
* postgresql16-pgvector-0.8.1-160000.1.1
* postgresql17-pgaudit-17.1-160000.3.1
* postgresql14-pgvector-debuginfo-0.8.1-160000.1.1
* libpq5-debuginfo-18.1-160000.1.1
* postgresql13-pgaudit-1.5.3-160000.3.1
* postgresql17-plpython-17.7-160000.1.1
* postgresql18-plpython-18.1-160000.1.1
* postgresql13-pgvector-0.8.1-160000.1.1
* postgresql17-contrib-17.7-160000.1.1
* SUSE Linux Enterprise Server for SAP Applications 16.0 (noarch)
* postgresql18-docs-18.1-160000.1.1
* postgresql-plperl-18-160000.1.1
* postgresql-pltcl-18-160000.1.1
* postgresql-server-18-160000.1.1
* postgresql17-docs-17.7-160000.1.1
* postgresql-contrib-18-160000.1.1
* postgresql-server-devel-18-160000.1.1
* postgresql-plpython-18-160000.1.1
* postgresql-docs-18-160000.1.1
* postgresql-18-160000.1.1
* postgresql-devel-18-160000.1.1
## References:
* https://www.suse.com/security/cve/CVE-2025-12817.html
* https://www.suse.com/security/cve/CVE-2025-12818.html
* https://bugzilla.suse.com/show_bug.cgi?id=1253332
* https://bugzilla.suse.com/show_bug.cgi?id=1253333
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20260203/f2c39483/attachment.htm>
More information about the sle-updates
mailing list