CVE-2018-10936

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

This update fixes the following issues:

bind-formula:

• Temporarily disable dnssec-validation as hotfix for bsc#1177790
• Update to version 0.1.1603299886.60e4bcf

grafana-formula:

• Use variable for product name
• Add support for system groups in Client Systems dashboard

postgresql-jdbc:

• Address CVE-2020-13692 (bsc#1172079)
• Add patch:
• Major changes since 9.4-1200:
  • License changed to BSD-2-Clause and BSD-3-Clause and Apache-2.0
  • Support PostgreSQL 9.5, 9.6, 10 11 and 12 added
  • Support for PostgreSQL versions below 8.2 was dropped
  • Support for JDK8, JDK9, JDK10, JDK11 and JDK12
  • Support for JDK 1.4 and 1.5 was dropped
  • Support for JDBC 4.2 added
  • Add maxResultBuffer property
  • Add caller push of binary data
  • Read only transactions
  • pkcs12 key functionality
  • New 'escapeSyntaxCallMode' connection property
  • Connection property to limit server error detail in exception exceptions
  • CancelQuery() to PGConnection public interface
  • Support for large update counts (JDBC 4.2)
  • Add Binary Support for Oid.NUMERIC and Oid.NUMERIC_ARRAY
  • Expose parameter status messages (GUC_REPORT) to the user
  • Log ignoring rollback when no transaction in progress
  • Map inet type to InetAddress
  • Change ISGENERATED to ISGENERATEDCOLUMN as per spec
  • Support temporary replication slots in ReplicationCreateSlotBuilder
  • Return function (PostgreSQL 11) columns in PgDatabaseMetaData#getFunctionColumns
  • Return information on create replication slot, now the snapshot_name is exported to allow a consistent snapshot in some uses cases
  • ssl=true implies sslmode=verify-full, that is it requires valid server certificate
  • Support for sslmode=allow/prefer/require
  • Added server hostname verification for non-default SSL factories in sslmode=verify-full (CVE-2018-10936)
  • PreparedStatement.setNull(int parameterIndex, int t, String typeName) no longer ignores the typeName argument if it is not setNull
  • Reduce the severity of the error log messages when an exception is re-thrown. The error will be thrown to caller to be dealt with so no need to log at this verbosity by pgjdbc
  • Deprecate Fastpath API PR 903
  • Support parenthesis in {oj ...} JDBC escape syntax
  • socksProxyHost is ignored in case it contains empty string
  • Support SCRAM-SHA-256 for PostgreSQL 10 in the JDBC 4.2 version (Java 8+) using the Ongres SCRAM library
  • Make SELECT INTO and CREATE TABLE AS return row counts to the client in their command tags
  • Support Subject Alternative Names for SSL connections
  • Support isAutoIncrement metadata for PostgreSQL 10 IDENTITY column
  • Support for primitive arrays PR 887 3e0491a
  • Implement support for get/setNetworkTimeout() in connections
  • Make GSS JAAS login optional, add an option 'jaasLogin'
  • Improve behaviour of ResultSet.getObject(int, Class)
  • Parse CommandComplete message using a regular expression, allows complete catch of server returned commands for INSERT, UPDATE, DELETE, SELECT, FETCH, MOVE,COPY and future commands.
  • Use 'time with timezone' and 'timestamp with timezone' as is and ignore the user provided Calendars, 'time' and 'timestamp' work as earlier except '00:00:00' now maps to 1970-01-01 and '24:00:00' uses the system provided Calendar ignoring the user-provided one
  • Change behaviour of multihost connection. The new behaviour is to try all secondaries first before trying the master
  • Drop support for the (insecure) crypt authentication method
  • slave and preferSlave values for the targetServerType connection property have been deprecated in favour of secondary and preferSecondary respectively
  • Statements with non-zero fetchSize no longer require server-side named handle. This might cause issues when using old PostgreSQL versions (pre-8.4)+fetchSize+interleaved ResultSet processing combo
  • Better logic for returning keyword detection.…