Security update for postgresql16 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:3153-1 Final 1 1 2024-09-06T09:23:02Z current 2024-09-06T09:23:02Z 2024-09-06T09:23:02Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for postgresql16 This update for postgresql16 fixes the following issues: - Upgrade to 12.20 (bsc#1229013) - CVE-2024-7348: PostgreSQL relation replacement during pg_dump executes arbitrary SQL. (bsc#1229013) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2024-3153,SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-3153,SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-3153,SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-3153,SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-3153,SUSE-SLE-Product-SLES_SAP-15-SP2-2024-3153,SUSE-SLE-Product-SLES_SAP-15-SP3-2024-3153,SUSE-Storage-7.1-2024-3153,openSUSE-SLE-15.5-2024-3153,openSUSE-SLE-15.6-2024-3153 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20243153-1/ Link for SUSE-SU-2024:3153-1 https://lists.suse.com/pipermail/sle-updates/2024-September/036810.html E-Mail link for SUSE-SU-2024:3153-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1229013 SUSE Bug 1229013 https://www.suse.com/security/cve/CVE-2024-7348/ SUSE CVE CVE-2024-7348 page SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 openSUSE Leap 15.5 openSUSE Leap 15.6 postgresql12-12.20-150200.8.63.1 postgresql12-contrib-12.20-150200.8.63.1 postgresql12-devel-12.20-150200.8.63.1 postgresql12-docs-12.20-150200.8.63.1 postgresql12-llvmjit-12.20-150200.8.63.1 postgresql12-llvmjit-devel-12.20-150200.8.63.1 postgresql12-plperl-12.20-150200.8.63.1 postgresql12-plpython-12.20-150200.8.63.1 postgresql12-pltcl-12.20-150200.8.63.1 postgresql12-server-12.20-150200.8.63.1 postgresql12-server-devel-12.20-150200.8.63.1 postgresql12-test-12.20-150200.8.63.1 postgresql12-12.20-150200.8.63.1 as a component of SUSE Enterprise Storage 7.1 postgresql12-contrib-12.20-150200.8.63.1 as a component of SUSE Enterprise Storage 7.1 postgresql12-devel-12.20-150200.8.63.1 as a component of SUSE Enterprise Storage 7.1 postgresql12-docs-12.20-150200.8.63.1 as a component of SUSE Enterprise Storage 7.1 postgresql12-plperl-12.20-150200.8.63.1 as a component of SUSE Enterprise Storage 7.1 postgresql12-plpython-12.20-150200.8.63.1 as a component of SUSE Enterprise Storage 7.1 postgresql12-pltcl-12.20-150200.8.63.1 as a component of SUSE Enterprise Storage 7.1 postgresql12-server-12.20-150200.8.63.1 as a component of SUSE Enterprise Storage 7.1 postgresql12-server-devel-12.20-150200.8.63.1 as a component of SUSE Enterprise Storage 7.1 postgresql12-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS postgresql12-contrib-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS postgresql12-devel-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS postgresql12-docs-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS postgresql12-plperl-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS postgresql12-plpython-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS postgresql12-pltcl-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS postgresql12-server-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS postgresql12-server-devel-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS postgresql12-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS postgresql12-contrib-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS postgresql12-devel-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS postgresql12-docs-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS postgresql12-plperl-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS postgresql12-plpython-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS postgresql12-pltcl-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS postgresql12-server-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS postgresql12-server-devel-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS postgresql12-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS postgresql12-contrib-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS postgresql12-devel-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS postgresql12-docs-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS postgresql12-plperl-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS postgresql12-plpython-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS postgresql12-pltcl-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS postgresql12-server-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS postgresql12-server-devel-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS postgresql12-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS postgresql12-contrib-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS postgresql12-devel-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS postgresql12-docs-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS postgresql12-plperl-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS postgresql12-plpython-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS postgresql12-pltcl-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS postgresql12-server-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS postgresql12-server-devel-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS postgresql12-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 postgresql12-contrib-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 postgresql12-devel-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 postgresql12-docs-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 postgresql12-plperl-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 postgresql12-plpython-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 postgresql12-pltcl-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 postgresql12-server-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 postgresql12-server-devel-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 postgresql12-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 postgresql12-contrib-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 postgresql12-devel-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 postgresql12-docs-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 postgresql12-plperl-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 postgresql12-plpython-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 postgresql12-pltcl-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 postgresql12-server-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 postgresql12-server-devel-12.20-150200.8.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 postgresql12-12.20-150200.8.63.1 as a component of openSUSE Leap 15.5 postgresql12-contrib-12.20-150200.8.63.1 as a component of openSUSE Leap 15.5 postgresql12-devel-12.20-150200.8.63.1 as a component of openSUSE Leap 15.5 postgresql12-docs-12.20-150200.8.63.1 as a component of openSUSE Leap 15.5 postgresql12-llvmjit-12.20-150200.8.63.1 as a component of openSUSE Leap 15.5 postgresql12-llvmjit-devel-12.20-150200.8.63.1 as a component of openSUSE Leap 15.5 postgresql12-plperl-12.20-150200.8.63.1 as a component of openSUSE Leap 15.5 postgresql12-plpython-12.20-150200.8.63.1 as a component of openSUSE Leap 15.5 postgresql12-pltcl-12.20-150200.8.63.1 as a component of openSUSE Leap 15.5 postgresql12-server-12.20-150200.8.63.1 as a component of openSUSE Leap 15.5 postgresql12-server-devel-12.20-150200.8.63.1 as a component of openSUSE Leap 15.5 postgresql12-test-12.20-150200.8.63.1 as a component of openSUSE Leap 15.5 postgresql12-12.20-150200.8.63.1 as a component of openSUSE Leap 15.6 postgresql12-contrib-12.20-150200.8.63.1 as a component of openSUSE Leap 15.6 postgresql12-devel-12.20-150200.8.63.1 as a component of openSUSE Leap 15.6 postgresql12-docs-12.20-150200.8.63.1 as a component of openSUSE Leap 15.6 postgresql12-llvmjit-12.20-150200.8.63.1 as a component of openSUSE Leap 15.6 postgresql12-llvmjit-devel-12.20-150200.8.63.1 as a component of openSUSE Leap 15.6 postgresql12-plperl-12.20-150200.8.63.1 as a component of openSUSE Leap 15.6 postgresql12-plpython-12.20-150200.8.63.1 as a component of openSUSE Leap 15.6 postgresql12-pltcl-12.20-150200.8.63.1 as a component of openSUSE Leap 15.6 postgresql12-server-12.20-150200.8.63.1 as a component of openSUSE Leap 15.6 postgresql12-server-devel-12.20-150200.8.63.1 as a component of openSUSE Leap 15.6 postgresql12-test-12.20-150200.8.63.1 as a component of openSUSE Leap 15.6 Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected. CVE-2024-7348 SUSE Enterprise Storage 7.1:postgresql12-12.20-150200.8.63.1 SUSE Enterprise Storage 7.1:postgresql12-contrib-12.20-150200.8.63.1 SUSE Enterprise Storage 7.1:postgresql12-devel-12.20-150200.8.63.1 SUSE Enterprise Storage 7.1:postgresql12-docs-12.20-150200.8.63.1 SUSE Enterprise Storage 7.1:postgresql12-plperl-12.20-150200.8.63.1 SUSE Enterprise Storage 7.1:postgresql12-plpython-12.20-150200.8.63.1 SUSE Enterprise Storage 7.1:postgresql12-pltcl-12.20-150200.8.63.1 SUSE Enterprise Storage 7.1:postgresql12-server-12.20-150200.8.63.1 SUSE Enterprise Storage 7.1:postgresql12-server-devel-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:postgresql12-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:postgresql12-contrib-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:postgresql12-devel-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:postgresql12-docs-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:postgresql12-plperl-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:postgresql12-plpython-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:postgresql12-pltcl-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:postgresql12-server-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:postgresql12-server-devel-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:postgresql12-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:postgresql12-contrib-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:postgresql12-devel-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:postgresql12-docs-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:postgresql12-plperl-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:postgresql12-plpython-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:postgresql12-pltcl-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:postgresql12-server-12.20-150200.8.63.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:postgresql12-server-devel-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP2-LTSS:postgresql12-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP2-LTSS:postgresql12-contrib-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP2-LTSS:postgresql12-devel-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP2-LTSS:postgresql12-docs-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP2-LTSS:postgresql12-plperl-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP2-LTSS:postgresql12-plpython-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP2-LTSS:postgresql12-pltcl-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP2-LTSS:postgresql12-server-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP2-LTSS:postgresql12-server-devel-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP3-LTSS:postgresql12-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP3-LTSS:postgresql12-contrib-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP3-LTSS:postgresql12-devel-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP3-LTSS:postgresql12-docs-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP3-LTSS:postgresql12-plperl-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP3-LTSS:postgresql12-plpython-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP3-LTSS:postgresql12-pltcl-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP3-LTSS:postgresql12-server-12.20-150200.8.63.1 SUSE Linux Enterprise Server 15 SP3-LTSS:postgresql12-server-devel-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:postgresql12-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:postgresql12-contrib-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:postgresql12-devel-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:postgresql12-docs-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:postgresql12-plperl-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:postgresql12-plpython-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:postgresql12-pltcl-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:postgresql12-server-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:postgresql12-server-devel-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:postgresql12-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:postgresql12-contrib-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:postgresql12-devel-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:postgresql12-docs-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:postgresql12-plperl-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:postgresql12-plpython-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:postgresql12-pltcl-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:postgresql12-server-12.20-150200.8.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:postgresql12-server-devel-12.20-150200.8.63.1 openSUSE Leap 15.5:postgresql12-12.20-150200.8.63.1 openSUSE Leap 15.5:postgresql12-contrib-12.20-150200.8.63.1 openSUSE Leap 15.5:postgresql12-devel-12.20-150200.8.63.1 openSUSE Leap 15.5:postgresql12-docs-12.20-150200.8.63.1 openSUSE Leap 15.5:postgresql12-llvmjit-12.20-150200.8.63.1 openSUSE Leap 15.5:postgresql12-llvmjit-devel-12.20-150200.8.63.1 openSUSE Leap 15.5:postgresql12-plperl-12.20-150200.8.63.1 openSUSE Leap 15.5:postgresql12-plpython-12.20-150200.8.63.1 openSUSE Leap 15.5:postgresql12-pltcl-12.20-150200.8.63.1 openSUSE Leap 15.5:postgresql12-server-12.20-150200.8.63.1 openSUSE Leap 15.5:postgresql12-server-devel-12.20-150200.8.63.1 openSUSE Leap 15.5:postgresql12-test-12.20-150200.8.63.1 openSUSE Leap 15.6:postgresql12-12.20-150200.8.63.1 openSUSE Leap 15.6:postgresql12-contrib-12.20-150200.8.63.1 openSUSE Leap 15.6:postgresql12-devel-12.20-150200.8.63.1 openSUSE Leap 15.6:postgresql12-docs-12.20-150200.8.63.1 openSUSE Leap 15.6:postgresql12-llvmjit-12.20-150200.8.63.1 openSUSE Leap 15.6:postgresql12-llvmjit-devel-12.20-150200.8.63.1 openSUSE Leap 15.6:postgresql12-plperl-12.20-150200.8.63.1 openSUSE Leap 15.6:postgresql12-plpython-12.20-150200.8.63.1 openSUSE Leap 15.6:postgresql12-pltcl-12.20-150200.8.63.1 openSUSE Leap 15.6:postgresql12-server-12.20-150200.8.63.1 openSUSE Leap 15.6:postgresql12-server-devel-12.20-150200.8.63.1 openSUSE Leap 15.6:postgresql12-test-12.20-150200.8.63.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243153-1/ https://www.suse.com/security/cve/CVE-2024-7348.html CVE-2024-7348 https://bugzilla.suse.com/1229013 SUSE Bug 1229013