CVE-2021-32029

A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.

A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.

A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (12.7)

Security Fix(es):

• postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

• postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

• postgresql: Memory disclosure in partitioned-table UPDATE ... RETURNING (CVE-2021-32029)

• postgresql: Partition constraint violation errors leak values of denied columns (CVE-2021-3393)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (13.3).

Security Fix(es):

• postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

• postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

• postgresql: Memory disclosure in partitioned-table UPDATE ... RETURNING (CVE-2021-32029)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (12.7)

Security Fix(es):

• postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

• postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

• postgresql: Memory disclosure in partitioned-table UPDATE ... RETURNING (CVE-2021-32029)

• postgresql: Partition constraint violation errors leak values of denied columns (CVE-2021-3393)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (13.3).

Security Fix(es):

• postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

• postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

• postgresql: Memory disclosure in partitioned-table UPDATE ... RETURNING (CVE-2021-32029)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.

Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027).

Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE. (CVE-2021-32028).

Memory disclosure in partitioned-table UPDATE ... RETURNING. (CVE-2021-32029).

This update for postgresql13 fixes the following issues:

• Upgrade to version 13.3:

• CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924).

• CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925).

• CVE-2021-32029: Fixed possibly-incorrect computation of UPDATE ... RETURNING outputs for joined cross-partition updates (bsc#1185926).

• Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168).

• Re-enable build of the llvmjit subpackage on SLE, but it will only be delivered on PackageHub for now (bsc#1183118).

• Disable icu for PostgreSQL 10 (and older) on TW (bsc#1179945).

This update for postgresql12 fixes the following issues:

Upgrade to version 12.7:

• CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924).

• CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925).

• CVE-2021-32029: Fixed possibly-incorrect computation of UPDATE ... RETURNING outputs for joined cross-partition updates (bsc#1185926).

• Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168).

• Re-enable build of the llvmjit subpackage on SLE, but it will only be delivered on PackageHub for now (bsc#1183118).

• Disable icu for PostgreSQL 10 (and older) on TW (bsc#1179945).

These are all security issues fixed in the postgresql11-11.13-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql12-12.8-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libecpg6-13.4-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql14-14.5-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql15-15.4-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql16-16.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql17-17.6-2.1 package on the GA media of openSUSE Tumbleweed.

This update for postgresql12 fixes the following issues:

• Upgrade to version 12.7:

• CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924).

• CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925).

• CVE-2021-32029: Fixed possibly-incorrect computation of UPDATE ... RETURNING 'pg_psql_temporary_savepoint' does not exist (bsc#1185926).

• CVE-2021-3393: Fixed information leakage in constraint-violation error messages (bsc#1182040).

• Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168).

• Re-enable build of the llvmjit subpackage on SLE, but it will only be delivered on PackageHub for now (bsc#1183118).

• Disable icu for PostgreSQL 10 (and older) on TW (bsc#1179945).

This update for postgresql13 fixes the following issues:

• Upgrade to version 13.3:

• CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924).

• CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925).

• CVE-2021-32029: Fixed possibly-incorrect computation of UPDATE ... RETURNING 'pg_psql_temporary_savepoint' does not exist (bsc#1185926).

• Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168).

• Re-enable build of the llvmjit subpackage on SLE, but it will only be delivered on PackageHub for now (bsc#1183118).

• Disable icu for PostgreSQL 10 (and older) on TW (bsc#1179945).

This update for postgresql13 fixes the following issues:

• Upgrade to version 13.3:

• CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924).

• CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925).

• CVE-2021-32029: Fixed possibly-incorrect computation of UPDATE ... RETURNING outputs for joined cross-partition updates (bsc#1185926).

• Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168).

• Re-enable build of the llvmjit subpackage on SLE, but it will only be delivered on PackageHub for now (bsc#1183118).

• Disable icu for PostgreSQL 10 (and older) on TW (bsc#1179945).

This update for postgresql13 fixes the following issues:

• Upgrade to version 13.3:

• CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924).

• CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925).

• CVE-2021-32029: Fixed possibly-incorrect computation of UPDATE ... RETURNING outputs for joined cross-partition updates (bsc#1185926).

• Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168).

• Re-enable build of the llvmjit subpackage on SLE, but it will only be delivered on PackageHub for now (bsc#1183118).

• Disable icu for PostgreSQL 10 (and older) on TW (bsc#1179945).

This update for postgresql12 fixes the following issues:

Upgrade to version 12.7:

• CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924).

• CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925).

• CVE-2021-32029: Fixed possibly-incorrect computation of UPDATE ... RETURNING outputs for joined cross-partition updates (bsc#1185926).

• Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168).

• Re-enable build of the llvmjit subpackage on SLE, but it will only be delivered on PackageHub for now (bsc#1183118).

• Disable icu for PostgreSQL 10 (and older) on TW (bsc#1179945).

This update for postgresql12 fixes the following issues:

• Upgrade to 12.12:

• CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension (bsc#1202368).

• Upgrade to 12.11:

• CVE-2022-1552: Confined additional operations within 'security restricted operation' sandboxes (bsc#1199475).

• Upgrade to 12.10 (bsc#1195680)

• Add constraints file with 12GB of memory for s390x as a workaround (boo#1190740)

• Upgrade to version 12.9 (bsc#1192516):

• CVE-2021-23214: Made the server reject extraneous data after an SSL or GSS encryption handshake

• CVE-2021-23222: Made libpq reject extraneous data after an SSL or GSS encryption handshake

• Upgrade to version 12.8:

• CVE-2021-3677: Fixed memory disclosure in certain queries (bsc#1189748).

• Upgrade to version 12.7:

• CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924).

• CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925).

• CVE-2021-32029: Fixed possibly-incorrect computation of UPDATE ... RETURNING 'pg_psql_temporary_savepoint' does not exist (bsc#1185926).

• Fixed build with llvm12 on s390x (bsc#1185952).

• Re-enabled icu for PostgreSQL 10 (bsc#1179945).

• Made the dependency of postgresqlXX-server-devel on llvm and clang optional (bsc#1187751).

• llvm12 breaks PostgreSQL 11 and 12 on s390x. Use llvm11 as a workaround (bsc#1185952).

• Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168).

Tom Lane discovered that PostgreSQL incorrect handled certain array subscripting calculations. An authenticated attacker could possibly use this issue to overwrite server memory and escalate privileges. (CVE-2021-32027)

Andres Freund discovered that PostgreSQL incorrect handled certain INSERT ... ON CONFLICT ... DO UPDATE commands. A remote attacker could possibly use this issue to read server memory and obtain sensitive information. (CVE-2021-32028)

Tom Lane discovered that PostgreSQL incorrect handled certain UPDATE ... RETURNING commands. A remote attacker could possibly use this issue to read server memory and obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-32029)