CVE-2020-1720

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (12.5).

Security Fix(es):

• postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

• postgresql: Multiple features escape "security restricted operation" sandbox (CVE-2020-25695)

• postgresql: Uncontrolled search path element in logical replication (CVE-2020-14349)

• postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

• postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

• postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (12.5).

Security Fix(es):

• postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

• postgresql: Multiple features escape "security restricted operation" sandbox (CVE-2020-25695)

• postgresql: Uncontrolled search path element in logical replication (CVE-2020-14349)

• postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

• postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

• postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.

Updated postgresql9.6 and postgresql11 packages fix security vulnerability:

The ALTER ... DEPENDS ON EXTENSION sub-commands do not perform authorization checks, which can allow an unprivileged user to drop any function, procedure, materialized view, index, or trigger under certain conditions. This attack is possible if an administrator has installed an extension and an unprivileged user can CREATE, or an extension owner either executes DROP EXTENSION predictably or can be convinced to execute DROP EXTENSION (CVE-2020-1720).

This update for postgresql10 fixes the following issues:

PostgreSQL was updated to version 10.12.

Security issue fixed:

• CVE-2020-1720: Fixed a missing authorization check in the ALTER ... DEPENDS ON extension (bsc#1163985).

This update was imported from the SUSE:SLE-15:Update update project.

This update for postgresql96, postgresql10 and postgresql12 fixes the following issues:

postgresql10 was updated to 10.13 (bsc#1171924).

https://www.postgresql.org/about/news/2038/ https://www.postgresql.org/docs/10/release-10-13.html

postgresql10 was updated to 10.12 (CVE-2020-1720, bsc#1163985)

• https://www.postgresql.org/about/news/2011/
• https://www.postgresql.org/docs/10/release-10-12.html

postgresql10 was updated to 10.11:

• https://www.postgresql.org/about/news/1994/
• https://www.postgresql.org/docs/10/release-10-11.html

postgresql12 was updated to 12.3 (bsc#1171924).

Bug Fixes and Improvements:

• Several fixes for GENERATED columns, including an issue where it was possible to crash or corrupt data in a table when the output of the generated column was the exact copy of a physical column on the table, e.g. if the expression called a function which could return its own input.
• Several fixes for ALTER TABLE, including ensuring the SET STORAGE directive is propagated to a table's indexes.
• Fix a potential race condition when using DROP OWNED BY while another session is deleting the same objects.
• Allow for a partition to be detached when it has inherited ROW triggers.
• Several fixes for REINDEX CONCURRENTLY, particularly with issues when a REINDEX CONCURRENTLY operation fails.
• Fix crash when COLLATE is applied to an uncollatable type in a partition bound expression.
• Fix performance regression in floating point overflow/underflow detection.
• Several fixes for full text search, particularly with phrase searching.
• Fix query-lifespan memory leak for a set-returning function used in a query's FROM clause.
• Several reporting fixes for the output of VACUUM VERBOSE.
• Allow input of type circle to accept the format (x,y),r, which is specified in the documentation.
• Allow for the get_bit() and set_bit() functions to not fail on bytea strings longer than 256MB.
• Avoid premature recycling of WAL segments during crash recovery, which could lead to WAL segments being recycled before being archived.
• Avoid attempting to fetch nonexistent WAL files from archive storage during recovery by skipping irrelevant timelines.
• Several fixes for logical replication and replication slots.
• Fix several race conditions in synchronous standby management, including one that occurred when changing the synchronous_standby_names setting.
• Several fixes for GSSAPI support, include a fix for a memory leak that occurred when using GSSAPI encryption.
• Ensure that members of the pg_read_all_stats role can read all statistics views.
• Fix performance regression in information_schema.triggers view.
• Fix memory leak in libpq when using sslmode=verify-full.
• Fix crash in psql when attempting to re-establish a failed connection.
• Allow tab-completion of the filename argument to \gx command in psql.
• Add pg_dump support for ALTER ... DEPENDS ON EXTENSION.
• Several other fixes for pg_dump, which include dumping comments on RLS policies and postponing restore of event triggers until the end.
• Ensure pg_basebackup generates valid tar files.
• pg_checksums skips tablespace subdirectories that belong to a different PostgreSQL major version
• Several Windows compatibility fixes

This update also contains timezone tzdata release 2020a for DST law changes in Morocco and the Canadian Yukon, plus historical corrections for Shanghai. The America/Godthab zone has been renamed to America/Nuuk to reflect current English usage ; however, the old name remains available as a compatibility link. This also updates initdb's list of known Windows time zone names to include recent additions.

For more details, check out:

• https://www.postgresql.org/docs/12/release-12-3.html

Other fixes:

• Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get a clean and complete cutover to the new packaging schema.

postgresql96 was updated to 9.6.19:

• CVE-2020-14350, boo#1175194: Make contrib modules' installation scripts more…

These are all security issues fixed in the postgresql10-10.18-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql11-11.13-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql12-12.8-1.3 package on the GA media of openSUSE Tumbleweed.

This update for postgresql, postgresql10, postgresql12 fixes the following issues:

Changes in the postgresql wrapper package:

• Sync ownership of /run/postgresql in the file list with tmpfiles.
• Use the correct content for .bash_profile (bsc#1153168).
• Stop shipping SUSEfirewall2 config files (bsc#1151591).
• Use /run/postgresql instead of /var/run/postgresql in %ghost and postgresql-tmpfiles.conf to avoid rpmlint warnings and errors.
• add /var/run/postgresql to the filelist. as %ghost for systemd systems and directly for non systemd systems

Changes in postgresql10:

• packaging changed to no longer build the libraries, these now come from postgresql12.

Changes in postgresql12:

Initial package for the postgresql 12 branch

https://www.postgresql.org/about/news/1976/

• Update to 12.2 (CVE-2020-1720) https://www.postgresql.org/about/news/2011/ https://www.postgresql.org/docs/12/release-12-2.html

• Avoid the dependency from the devel package to the main package. devel packages are exclusive, thus ecpg does not require update-alternatives.

• Remove unused build dependencies from the client libs package: LVM, icu, selinux, systemd.

• Update to 12.1

  https://www.postgresql.org/docs/12/release-12-1.html https://www.postgresql.org/about/news/1994/

• add requires to the server-devel package for the libs that are returned by pg_config --libs

python-psycopg2 was updated to 2.8.4 to allow working with postgresql12.

This update for postgresql96 fixes the following issues:

PostgreSQL was updated to version 9.6.17.

Security issue fixed:

• CVE-2020-1720: Fixed a missing authorization check in the ALTER ... DEPENDS ON extension (bsc#1163985).

This update for postgresql10 fixes the following issues:

PostgreSQL was updated to version 10.12.

Security issue fixed:

• CVE-2020-1720: Fixed a missing authorization check in the ALTER ... DEPENDS ON extension (bsc#1163985).

This update for postgresql10 fixes the following issues:

PostgreSQL was updated to version 10.12.

Security issue fixed:

• CVE-2020-1720: Fixed a missing authorization check in the ALTER ... DEPENDS ON extension (bsc#1163985).

This update for postgresql10 fixes the following issues:

PostgreSQL was updated to version 10.12.

Security issue fixed:

• CVE-2020-1720: Fixed a missing authorization check in the ALTER ... DEPENDS ON extension (bsc#1163985).

This update for postgresql10 and postgresql12 fixes the following issues:

postgresql10 was updated to 10.13 (bsc#1171924).

https://www.postgresql.org/about/news/2038/ https://www.postgresql.org/docs/10/release-10-13.html

postgresql10 was updated to 10.12 (CVE-2020-1720, bsc#1163985)

• https://www.postgresql.org/about/news/2011/
• https://www.postgresql.org/docs/10/release-10-12.html

postgresql10 was updated to 10.11:

• https://www.postgresql.org/about/news/1994/
• https://www.postgresql.org/docs/10/release-10-11.html

postgresql12 was updated to 12.3 (bsc#1171924).

Bug Fixes and Improvements:

• Several fixes for GENERATED columns, including an issue where it was possible to crash or corrupt data in a table when the output of the generated column was the exact copy of a physical column on the table, e.g. if the expression called a function which could return its own input.
• Several fixes for ALTER TABLE, including ensuring the SET STORAGE directive is propagated to a table's indexes.
• Fix a potential race condition when using DROP OWNED BY while another session is deleting the same objects.
• Allow for a partition to be detached when it has inherited ROW triggers.
• Several fixes for REINDEX CONCURRENTLY, particularly with issues when a REINDEX CONCURRENTLY operation fails.
• Fix crash when COLLATE is applied to an uncollatable type in a partition bound expression.
• Fix performance regression in floating point overflow/underflow detection.
• Several fixes for full text search, particularly with phrase searching.
• Fix query-lifespan memory leak for a set-returning function used in a query's FROM clause.
• Several reporting fixes for the output of VACUUM VERBOSE.
• Allow input of type circle to accept the format (x,y),r, which is specified in the documentation.
• Allow for the get_bit() and set_bit() functions to not fail on bytea strings longer than 256MB.
• Avoid premature recycling of WAL segments during crash recovery, which could lead to WAL segments being recycled before being archived.
• Avoid attempting to fetch nonexistent WAL files from archive storage during recovery by skipping irrelevant timelines.
• Several fixes for logical replication and replication slots.
• Fix several race conditions in synchronous standby management, including one that occurred when changing the synchronous_standby_names setting.
• Several fixes for GSSAPI support, include a fix for a memory leak that occurred when using GSSAPI encryption.
• Ensure that members of the pg_read_all_stats role can read all statistics views.
• Fix performance regression in information_schema.triggers view.
• Fix memory leak in libpq when using sslmode=verify-full.
• Fix crash in psql when attempting to re-establish a failed connection.
• Allow tab-completion of the filename argument to \gx command in psql.
• Add pg_dump support for ALTER ... DEPENDS ON EXTENSION.
• Several other fixes for pg_dump, which include dumping comments on RLS policies and postponing restore of event triggers until the end.
• Ensure pg_basebackup generates valid tar files.
• pg_checksums skips tablespace subdirectories that belong to a different PostgreSQL major version
• Several Windows compatibility fixes

This update also contains timezone tzdata release 2020a for DST law changes in Morocco and the Canadian Yukon, plus historical corrections for Shanghai. The America/Godthab zone has been renamed to America/Nuuk to reflect current English usage ; however, the old name remains available as a compatibility link. This also updates initdb's list of known Windows time zone names to include recent additions.

For more details, check out:

• https://www.postgresql.org/docs/12/release-12-3.html

Other fixes:

• Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get a clean and complete cutover to the new packaging schema.

It was discovered that PostgreSQL incorrectly performed authorization checks when handling the "ALTER ... DEPENDS ON EXTENSION" sub-commands. A remote attacker could possibly use this issue to drop any function, procedure, materialized view, index, or trigger under certain conditions.