Advisories » MGASA-2019-0225

Updated postgresql packages fix security vulnerabilities

Publication date: 18 Aug 2019
Modification date: 18 Aug 2019
Type: security
Affected Mageia releases : 6 , 7
CVE: CVE-2019-10208 , CVE-2019-10209

Description

Updated postgresql packages fix security vulnerabilities:

Given a suitable SECURITY DEFINER function, an attacker can execute
arbitrary SQL under the identity of the function owner. An attack requires
EXECUTE permission on the function, which must itself contain a function
call having inexact argument type match. For example, length('foo'::varchar)
and length('foo') are inexact, while length('foo'::text) is exact
(CVE-2019-10208).

In a database containing hypothetical, user-defined hash equality operators,
an attacker could read arbitrary bytes of server memory. For an attack to
become possible, a superuser would need to create unusual operators. It is
possible for operators not purpose-crafted for attack to have the properties
that enable an attack, but we are not aware of specific examples
(CVE-2019-10209).

This update also fixes over 40 bugs that were reported in the last several
months.  See the upstream release notes for details.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=25260
• https://www.postgresql.org/docs/9.4/release-9-4-24.html
• https://www.postgresql.org/docs/9.6/release-9-6-15.html
• https://www.postgresql.org/docs/11/release-11-5.html
• https://www.postgresql.org/about/news/1960/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10208
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10209

SRPMS

7/core

• postgresql9.6-9.6.15-1.mga7
• postgresql11-11.5-1.mga7

6/core

• postgresql9.4-9.4.24-1.mga6
• postgresql9.6-9.6.15-1.mga6