CVE-2020-14349

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (12.5).

Security Fix(es):

• postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

• postgresql: Multiple features escape "security restricted operation" sandbox (CVE-2020-25695)

• postgresql: Uncontrolled search path element in logical replication (CVE-2020-14349)

• postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

• postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

• postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version: postgresql (12.5).

Security Fix(es):

• postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

• postgresql: Multiple features escape "security restricted operation" sandbox (CVE-2020-25695)

• postgresql: Uncontrolled search path element in logical replication (CVE-2020-14349)

• postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

• postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

• postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication. (CVE-2020-14349)

It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. (CVE-2020-14350)

This update for postgresql, postgresql96, postgresql10, postgresql12 fixes the following issues:

Postgresql12 was updated to 12.3 (bsc#1171924).

• https://www.postgresql.org/about/news/2038/

• https://www.postgresql.org/docs/12/release-12-3.html

• Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get a clean and complete cutover to the new packaging schema.

Also changed in the postgresql wrapper package:

• Bump version to 12.0.1, so that the binary packages also have a cut-point to conflict with.

• Conflict with versions of the binary packages prior to the May 2020 update, because we changed the package layout at that point and need a clean cutover.

• Bump package version to 12, but leave default at 10 for SLE-15 and SLE-15-SP1.

postgresql11 was updated to 11.9:

• CVE-2020-14349, bsc#1175193: Set a secure search_path in logical replication walsenders and apply workers
• CVE-2020-14350, bsc#1175194: Make contrib modules' installation scripts more secure.
• https://www.postgresql.org/docs/11/release-11-9.html

• Pack the /usr/lib/postgresql symlink only into the main package.

postgresql11 was updated to 11.8 (bsc#1171924).

• https://www.postgresql.org/about/news/2038/
• https://www.postgresql.org/docs/11/release-11-8.html

• Unify the spec file to work across all current PostgreSQL versions to simplify future maintenance.
• Move from the 'libs' build flavour to a 'mini' package that will only be used inside the build service and not get shipped, to avoid confusion with the debuginfo packages (bsc#1148643).

postgresql10 was updated to 10.13 (bsc#1171924).

• https://www.postgresql.org/about/news/2038/

• https://www.postgresql.org/docs/10/release-10-13.html

• Unify the spec file to work across all current PostgreSQL versions to simplify future maintenance.

• Move from the 'libs' build flavour to a 'mini' package that will only be used inside the build service and not get shipped, to avoid confusion with the debuginfo packages (bsc#1148643).

postgresql96 was updated to 9.6.19:

• CVE-2020-14350, boo#1175194: Make contrib modules' installation scripts more secure.
• https://www.postgresql.org/docs/9.6/release-9-6-19.html

• Pack the /usr/lib/postgresql symlink only into the main package.

• Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get a clean and complete cutover to the new packaging schema.

• update to 9.6.18 (boo#1171924). https://www.postgresql.org/about/news/2038/ https://www.postgresql.org/docs/9.6/release-9-6-18.html

• Unify the spec file to work across all current PostgreSQL versions to simplify future maintenance.

• Move from the 'libs' build flavour to a 'mini' package that will only be used inside the build service and not get shipped, to avoid confusion with the debuginfo packages (boo#1148643).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for postgresql12 fixes the following issues:

• update to 12.4:
  • CVE-2020-14349, bsc#1175193: Set a secure search_path in logical replication walsenders and apply workers
  • CVE-2020-14350, bsc#1175194: Make contrib modules' installation scripts more secure.
  • https://www.postgresql.org/docs/12/release-12-4.html

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for postgresql12 fixes the following issues:

• update to 12.4:
  • CVE-2020-14349, bsc#1175193: Set a secure search_path in logical replication walsenders and apply workers
  • CVE-2020-14350, bsc#1175194: Make contrib modules' installation scripts more secure.
  • https://www.postgresql.org/docs/12/release-12-4.html

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for postgresql10 fixes the following issues:

• update to 10.14:
  • CVE-2020-14349, bsc#1175193: Set a secure search_path in logical replication walsenders and apply workers
  • CVE-2020-14350, bsc#1175194: Make contrib modules' installation scripts more secure.
  • https://www.postgresql.org/docs/10/release-10-14.html

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for postgresql10 fixes the following issues:

• update to 10.14:
  • CVE-2020-14349, bsc#1175193: Set a secure search_path in logical replication walsenders and apply workers
  • CVE-2020-14350, bsc#1175194: Make contrib modules' installation scripts more secure.
  • https://www.postgresql.org/docs/10/release-10-14.html

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the postgresql10-10.18-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql11-11.13-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql12-12.8-1.3 package on the GA media of openSUSE Tumbleweed.

This update for postgresql10 fixes the following issues:

• update to 10.14:
  • CVE-2020-14349, bsc#1175193: Set a secure search_path in logical replication walsenders and apply workers
  • CVE-2020-14350, bsc#1175194: Make contrib modules' installation scripts more secure.
  • https://www.postgresql.org/docs/10/release-10-14.html

This update for postgresql12 fixes the following issues:

• update to 12.4:
  • CVE-2020-14349, bsc#1175193: Set a secure search_path in logical replication walsenders and apply workers
  • CVE-2020-14350, bsc#1175194: Make contrib modules' installation scripts more secure.
  • https://www.postgresql.org/docs/12/release-12-4.html

This update for postgresql12 fixes the following issues:

• update to 12.4:
  • CVE-2020-14349, bsc#1175193: Set a secure search_path in logical replication walsenders and apply workers
  • CVE-2020-14350, bsc#1175194: Make contrib modules' installation scripts more secure.
  • https://www.postgresql.org/docs/12/release-12-4.html

This update for postgresql10 fixes the following issues:

• update to 10.14:
  • CVE-2020-14349, bsc#1175193: Set a secure search_path in logical replication walsenders and apply workers
  • CVE-2020-14350, bsc#1175194: Make contrib modules' installation scripts more secure.
  • https://www.postgresql.org/docs/10/release-10-14.html

This update for postgresql10 fixes the following issues:

Upgrade to version 10.15:

• CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries.
• CVE-2020-25694, bsc#1178667: a) Fix usage of complex connection-string parameters in pg_dump, pg_restore, clusterdb, reindexdb, and vacuumdb. b) When psql's \connect command re-uses connection parameters, ensure that all non-overridden parameters from a previous connection string are re-used.
• CVE-2020-25696, bsc#1178668: Prevent psql's \gset command from modifying specially-treated variables.
• https://www.postgresql.org/about/news/2111/
• https://www.postgresql.org/docs/10/release-10-15.html

Update to 10.14:

• CVE-2020-14349, bsc#1175193: Set a secure search_path in logical replication walsenders and apply workers
• CVE-2020-14350, bsc#1175194: Make contrib modules' installation scripts more secure.
• https://www.postgresql.org/docs/10/release-10-14.html

This update for postgresql12 fixes the following issues:

Upgrade to version 12.5:

• CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries.
• CVE-2020-25694, bsc#1178667: a) Fix usage of complex connection-string parameters in pg_dump, pg_restore, clusterdb, reindexdb, and vacuumdb. b) When psql's \connect command re-uses connection parameters, ensure that all non-overridden parameters from a previous connection string are re-used.
• CVE-2020-25696, bsc#1178668: Prevent psql's \gset command from modifying specially-treated variables.
• Fix recently-added timetz test case so it works when the USA is not observing daylight savings time. (obsoletes postgresql-timetz.patch)
• https://www.postgresql.org/about/news/2111/
• https://www.postgresql.org/docs/12/release-12-5.html

The previous postgresql12 update already addressed:

Update to 12.4:

• CVE-2020-14349, bsc#1175193: Set a secure search_path in logical replication walsenders and apply workers

• CVE-2020-14350, bsc#1175194: Make contrib modules' installation scripts more secure.

• https://www.postgresql.org/docs/12/release-12-4.html

Noah Misch discovered that PostgreSQL incorrectly handled the search_path setting when used with logical replication. A remote attacker could possibly use this issue to execute arbitrary SQL code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14349)

Andres Freund discovered that PostgreSQL incorrectly handled search path elements in CREATE EXTENSION. A remote attacker could possibly use this issue to execute arbitrary SQL code. (CVE-2020-14350)