CVE-2020-13692

PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.

PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.

Security Fix(es):

• postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML (CVE-2020-13692)

This update introduces a backwards incompatible change required to resolve this issue. Refer to the Rocky Enterprise Software Foundation Knowledgebase article 5266441 linked to in the References section for information on how to re-enable the old insecure behavior.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.

Security Fix(es):

• postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML (CVE-2020-13692)

This update introduces a backwards incompatible change required to resolve this issue. Refer to the AlmaLinux Knowledgebase article 5266441 linked to in the References section for information on how to re-enable the old insecure behavior.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.

XML external entity (XXE) vulnerability in PgSQLXML (CVE-2020-13692).

This update fixes the following issues:

bind-formula:

• Temporarily disable dnssec-validation as hotfix for bsc#1177790
• Update to version 0.1.1603299886.60e4bcf

grafana-formula:

• Use variable for product name
• Add support for system groups in Client Systems dashboard

postgresql-jdbc:

• Address CVE-2020-13692 (bsc#1172079)
• Add patch:
• Major changes since 9.4-1200:
  • License changed to BSD-2-Clause and BSD-3-Clause and Apache-2.0
  • Support PostgreSQL 9.5, 9.6, 10 11 and 12 added
  • Support for PostgreSQL versions below 8.2 was dropped
  • Support for JDK8, JDK9, JDK10, JDK11 and JDK12
  • Support for JDK 1.4 and 1.5 was dropped
  • Support for JDBC 4.2 added
  • Add maxResultBuffer property
  • Add caller push of binary data
  • Read only transactions
  • pkcs12 key functionality
  • New 'escapeSyntaxCallMode' connection property
  • Connection property to limit server error detail in exception exceptions
  • CancelQuery() to PGConnection public interface
  • Support for large update counts (JDBC 4.2)
  • Add Binary Support for Oid.NUMERIC and Oid.NUMERIC_ARRAY
  • Expose parameter status messages (GUC_REPORT) to the user
  • Log ignoring rollback when no transaction in progress
  • Map inet type to InetAddress
  • Change ISGENERATED to ISGENERATEDCOLUMN as per spec
  • Support temporary replication slots in ReplicationCreateSlotBuilder
  • Return function (PostgreSQL 11) columns in PgDatabaseMetaData#getFunctionColumns
  • Return information on create replication slot, now the snapshot_name is exported to allow a consistent snapshot in some uses cases
  • ssl=true implies sslmode=verify-full, that is it requires valid server certificate
  • Support for sslmode=allow/prefer/require
  • Added server hostname verification for non-default SSL factories in sslmode=verify-full (CVE-2018-10936)
  • PreparedStatement.setNull(int parameterIndex, int t, String typeName) no longer ignores the typeName argument if it is not setNull
  • Reduce the severity of the error log messages when an exception is re-thrown. The error will be thrown to caller to be dealt with so no need to log at this verbosity by pgjdbc
  • Deprecate Fastpath API PR 903
  • Support parenthesis in {oj ...} JDBC escape syntax
  • socksProxyHost is ignored in case it contains empty string
  • Support SCRAM-SHA-256 for PostgreSQL 10 in the JDBC 4.2 version (Java 8+) using the Ongres SCRAM library
  • Make SELECT INTO and CREATE TABLE AS return row counts to the client in their command tags
  • Support Subject Alternative Names for SSL connections
  • Support isAutoIncrement metadata for PostgreSQL 10 IDENTITY column
  • Support for primitive arrays PR 887 3e0491a
  • Implement support for get/setNetworkTimeout() in connections
  • Make GSS JAAS login optional, add an option 'jaasLogin'
  • Improve behaviour of ResultSet.getObject(int, Class)
  • Parse CommandComplete message using a regular expression, allows complete catch of server returned commands for INSERT, UPDATE, DELETE, SELECT, FETCH, MOVE,COPY and future commands.
  • Use 'time with timezone' and 'timestamp with timezone' as is and ignore the user provided Calendars, 'time' and 'timestamp' work as earlier except '00:00:00' now maps to 1970-01-01 and '24:00:00' uses the system provided Calendar ignoring the user-provided one
  • Change behaviour of multihost connection. The new behaviour is to try all secondaries first before trying the master
  • Drop support for the (insecure) crypt authentication method
  • slave and preferSlave values for the targetServerType connection property have been deprecated in favour of secondary and preferSecondary respectively
  • Statements with non-zero fetchSize no longer require server-side named handle. This might cause issues when using old PostgreSQL versions (pre-8.4)+fetchSize+interleaved ResultSet processing combo
  • Better logic for returning keyword detection.…

This update fixes the following issues:

image-sync-formula:

• Send image_synced event to master

postgresql-jdbc:

• Address CVE-2020-13692 (bsc#1172079)

pxe-yomi-image-sle15:

• Update config.sh based on last JeOS template
• Update JEOS_LOCALE to en_US.UTF-8
• Support config{_url}{_name} for user provided configuration

python-susemanager-retail:

• Handle organizations in retail_create_delta

saltboot-formula:

• Support older SLE11 cryptsetup (bsc#1172287)
• Use images with 'synced' flag

spacecmd:

• Fix: make spacecmd build on Debian

spacewalk-admin:

• Use the license macro to mark the LICENSE in the package so that when installing without docs, it does install the LICENSE file
• Prevent javax.net.ssl.SSLHandshakeException after upgrading from SUSE Manager 3.2 (bsc#1177435)

spacewalk-backend:

• Fix missing LiteServer.add_suse_products method (bsc#1178704)
• Do not raise TypeError when processing SUSE products (bsc#1178704)
• Fix spacewalk-repo-sync to successfully manage and sync ULN repositories
• Fix errors in spacewalk-debug and align postgresql queries to new DB version
• ISS: Differentiate packages with same nevra but different checksum in the same channel (bsc#1178195)
• Re-enables possibility to use local repos with repo-sync (bsc#1175607)
• Add allow_vendor_change option to rhn clients for dist upgrades

spacewalk-certs-tools:

• Improve check for correct CA trust store directory (bsc#1176417)

spacewalk-client-tools:

• Update translations

spacewalk-java:

• Update content sensitive help links
• Update exception message in findSyncedMandatoryChannels
• Report resolved module dependencies on CLM project details page
• Allow creating custom ULN repositories with uln:// urls
• Change message 'Minion is down' to be more accurate
• Localize documentation links
• Temp: revert Sync state modules when starting action chain execution (bsc#1177336)
• Fix check for available products on ISS Slaves (bsc#1177184)
• XMLRPC: Report architecture label in the list of installed packages (bsc#1176898)
• Get media.1/products for cloned channels (bsc#1178303)
• Calculate size to truncate a history message based on the htmlified version (bsc#1178503)
• Make image pillar visible only in buildhost organization
• Maintain list of synced images in pillar
• Enable validation of Content Lifecycle Management entities in the XMLRPC API (bsc#1177706)
• Fix the order of the arguments in the XMLRPC API doc for contentmanagement.buildProject (bsc#1177704)
• Fix repo url of AppStream in generated RHEL/Centos 8 kickstart file (bsc#1175739)
• Log token verify errors and check for expired tokens
• Show only kernel options in advanced autoinstallation page when working with a salt minion (bsc#1177767)
• Show cluster upgrade plan in the upgrade UI
• Take pool and volume from Salt virt.vm_info for files and blocks disks (bsc#1175987)
• Add new allowVendorChange flag for dist upgrades
• Sync state modules when starting action chain execution (bsc#1177336)
• Enable redfish power management by default

spacewalk-search:

• Add multi lang support to the document search

spacewalk-setup:

• Add sock_pool_size setting by default for better performance

spacewalk-web:

• Update content sensitive help links
• Fix mandatory channels JS API to finish loading in case of error (bsc#1178839)
• Fix the search panel in CLM filters page
• Localize documentation links
• Fix link to documentation in Admin -> Manager Configuration -> Monitoring (bsc#1176172)
• Show cluster upgrade plan in the upgrade UI
• Don't allow selecting spice for Xen PV and PVH guests

supportutils-plugin-susemanager:

• Remove checks for obsolete packages
• Gather new configfiles
• Add more important informations

susemanager:

• Adapt Debian10 bootstrap repository definition for salt on Python 3
• Add --force to mgr-create-bootstrap-repo to enforce generation even when some products are not synchronized

susemanager-doc-indexes:

• Added warning about local repositories in the…

This update for postgresql-jdbc fixes the following issues:

• CVE-2020-13692: Fixed a XML External Entity vulnerability (bsc#1172746) .

It was discovered that PostgreSQL JDBC Driver incorrectly handled certain requests from external entities. A remote attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code.