Security update for PostgreSQL
SUSE Security Update: Security update for PostgreSQL
This update provides PostgreSQL 8.3.20. As part of this
update, the packaging scheme has been changed to
accomodate an optional parallel installation of newer
PostgreSQL versions.
The changes in 8.3.20 are:
*
Prevent access to external files/URLs via XML entity
references. xml_parse() would attempt to fetch external
files or URLs as needed to resolve DTD and entity
references in an XML value, thus allowing unprivileged
database users to attempt to fetch data with the privileges
of the database server (CVE-2012-3489, bnc#776524).
*
Prevent access to external files/URLs via
"contrib/xml2"'s xslt_process(). libxslt offers the ability
to read and write both files and URLs through stylesheet
commands, thus allowing unprivileged database users to both
read and write data with the privileges of the database
server. Disable that through proper use of libxslt's
security options. (CVE-2012-3488, bnc#776523). Also, remove
xslt_process()'s ability to fetch documents and stylesheets
from external files/URLs.
*
Fix incorrect password transformation in
contrib/pgcrypto's DES crypt() function. If a password
string contained the byte value 0x80, the remainder of the
password was ignored, causing the password to be much
weaker than it appeared. With this fix, the rest of the
string is properly included in the DES hash. Any stored
password values that are affected by this bug will thus no
longer match, so the stored values may need to be updated.
(CVE-2012-2143)
*
Ignore SECURITY DEFINER and SET attributes for a
procedural language's call handler. Applying such
attributes to a call handler could crash the server.
(CVE-2012-2655)
*
Allow numeric timezone offsets in timestamp input to
be up to 16 hours away from UTC. Some historical time zones
have offsets larger than 15 hours, the previous limit. This
could result in dumped data values being rejected during
reload.
*
Fix timestamp conversion to cope when the given time
is exactly the last DST transition time for the current
timezone. This oversight has been there a long time, but
was not noticed previously because most DST-using zones are
presumed to have an indefinite sequence of future DST
transitions.
*
Fix text to name and char to name casts to perform
string truncation correctly in multibyte encodings.
*
Fix memory copying bug in to_tsquery().
*
Fix slow session startup when pg_attribute is very
large. If pg_attribute exceeds one-fourth of
shared_buffers, cache rebuilding code that is sometimes
needed during session start would trigger the
synchronized-scan logic, causing it to take many times
longer than normal. The problem was particularly acute if
many new sessions were starting at once.
*
Ensure sequential scans check for query cancel
reasonably often. A scan encountering many consecutive
pages that contain no live tuples would not respond to
interrupts meanwhile.
*
Show whole-row variables safely when printing views
or rules. Corner cases involving ambiguous names (that is,
the name could be either a table or column name of the
query) were printed in an ambiguous way, risking that the
view or rule would be interpreted differently after dump
and reload. Avoid the ambiguous case by attaching a no-op
cast.
*
Ensure autovacuum worker processes perform stack
depth checking properly. Previously, infinite recursion in
a function invoked by auto-ANALYZE could crash worker
processes.
*
Fix logging collector to not lose log coherency under
high load. The collector previously could fail to
reassemble large messages if it got too busy.
*
Fix logging collector to ensure it will restart file
rotation after receiving SIGHUP.
*
Fix PL/pgSQL's GET DIAGNOSTICS command when the
target is the function's first variable.
*
Fix several performance problems in pg_dump when the
database contains many objects. pg_dump could get very slow
if the database contained many schemas, or if many objects
are in dependency loops, or if there are many owned
sequences.
*
Fix contrib/dblink's dblink_exec() to not leak
temporary database connections upon error.
Security Issue references:
* CVE-2012-2143
>
* CVE-2012-2655
>
* CVE-2012-3489
>
* CVE-2012-3488
>
http://support.novell.com/security/cve/CVE-2012-2143.html
http://support.novell.com/security/cve/CVE-2012-2655.html
http://support.novell.com/security/cve/CVE-2012-3488.html
http://support.novell.com/security/cve/CVE-2012-3489.html
https://bugzilla.novell.com/760511
https://bugzilla.novell.com/765069
https://bugzilla.novell.com/766799
https://bugzilla.novell.com/767505
https://bugzilla.novell.com/770193
https://bugzilla.novell.com/773771
https://bugzilla.novell.com/774616
https://bugzilla.novell.com/774617
https://bugzilla.novell.com/775399
https://bugzilla.novell.com/775402
https://bugzilla.novell.com/776523
https://bugzilla.novell.com/776524
http://download.suse.com/patch/finder/?keywords=a40b143814a37b566fd7889125c16b7d
| Announcement ID: | SUSE-SU-2012:1021-1 |
| Rating: | low |
| References: | #760511 #765069 #766799 #767505 #770193 #773771 #774616 #774617 #775399 #775402 #776523 #776524 |
| Affected Products: |
An update that solves four vulnerabilities and has 8 fixes is now available. It includes one version update.
Description:
This update provides PostgreSQL 8.3.20. As part of this
update, the packaging scheme has been changed to
accomodate an optional parallel installation of newer
PostgreSQL versions.
The changes in 8.3.20 are:
*
Prevent access to external files/URLs via XML entity
references. xml_parse() would attempt to fetch external
files or URLs as needed to resolve DTD and entity
references in an XML value, thus allowing unprivileged
database users to attempt to fetch data with the privileges
of the database server (CVE-2012-3489, bnc#776524).
*
Prevent access to external files/URLs via
"contrib/xml2"'s xslt_process(). libxslt offers the ability
to read and write both files and URLs through stylesheet
commands, thus allowing unprivileged database users to both
read and write data with the privileges of the database
server. Disable that through proper use of libxslt's
security options. (CVE-2012-3488, bnc#776523). Also, remove
xslt_process()'s ability to fetch documents and stylesheets
from external files/URLs.
*
Fix incorrect password transformation in
contrib/pgcrypto's DES crypt() function. If a password
string contained the byte value 0x80, the remainder of the
password was ignored, causing the password to be much
weaker than it appeared. With this fix, the rest of the
string is properly included in the DES hash. Any stored
password values that are affected by this bug will thus no
longer match, so the stored values may need to be updated.
(CVE-2012-2143)
*
Ignore SECURITY DEFINER and SET attributes for a
procedural language's call handler. Applying such
attributes to a call handler could crash the server.
(CVE-2012-2655)
*
Allow numeric timezone offsets in timestamp input to
be up to 16 hours away from UTC. Some historical time zones
have offsets larger than 15 hours, the previous limit. This
could result in dumped data values being rejected during
reload.
*
Fix timestamp conversion to cope when the given time
is exactly the last DST transition time for the current
timezone. This oversight has been there a long time, but
was not noticed previously because most DST-using zones are
presumed to have an indefinite sequence of future DST
transitions.
*
Fix text to name and char to name casts to perform
string truncation correctly in multibyte encodings.
*
Fix memory copying bug in to_tsquery().
*
Fix slow session startup when pg_attribute is very
large. If pg_attribute exceeds one-fourth of
shared_buffers, cache rebuilding code that is sometimes
needed during session start would trigger the
synchronized-scan logic, causing it to take many times
longer than normal. The problem was particularly acute if
many new sessions were starting at once.
*
Ensure sequential scans check for query cancel
reasonably often. A scan encountering many consecutive
pages that contain no live tuples would not respond to
interrupts meanwhile.
*
Show whole-row variables safely when printing views
or rules. Corner cases involving ambiguous names (that is,
the name could be either a table or column name of the
query) were printed in an ambiguous way, risking that the
view or rule would be interpreted differently after dump
and reload. Avoid the ambiguous case by attaching a no-op
cast.
*
Ensure autovacuum worker processes perform stack
depth checking properly. Previously, infinite recursion in
a function invoked by auto-ANALYZE could crash worker
processes.
*
Fix logging collector to not lose log coherency under
high load. The collector previously could fail to
reassemble large messages if it got too busy.
*
Fix logging collector to ensure it will restart file
rotation after receiving SIGHUP.
*
Fix PL/pgSQL's GET DIAGNOSTICS command when the
target is the function's first variable.
*
Fix several performance problems in pg_dump when the
database contains many objects. pg_dump could get very slow
if the database contained many schemas, or if many objects
are in dependency loops, or if there are many owned
sequences.
*
Fix contrib/dblink's dblink_exec() to not leak
temporary database connections upon error.
Security Issue references:
* CVE-2012-2143
* CVE-2012-2655
* CVE-2012-3489
* CVE-2012-3488
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 11 SP2:
zypper in -t patch slessp1-postgresql-6697 - SUSE Linux Enterprise Server 11 SP1 for VMware:
zypper in -t patch slessp1-postgresql-6697 - SUSE Linux Enterprise Server 11 SP1:
zypper in -t patch slessp1-postgresql-6697 - SUSE Linux Enterprise Desktop 11 SP2:
zypper in -t patch sledsp1-postgresql-6697 - SUSE Linux Enterprise Desktop 11 SP1:
zypper in -t patch sledsp1-postgresql-6697
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 8.3.20]:
- postgresql-8.3.20-0.4.1
- postgresql-contrib-8.3.20-0.4.1
- postgresql-docs-8.3.20-0.4.1
- postgresql-server-8.3.20-0.4.1
- SUSE Linux Enterprise Server 11 SP2 (noarch):
- postgresql-init-9.1-0.6.10.1
- SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64) [New Version: 8.3.20]:
- postgresql-8.3.20-0.4.1
- postgresql-contrib-8.3.20-0.4.1
- postgresql-docs-8.3.20-0.4.1
- postgresql-server-8.3.20-0.4.1
- SUSE Linux Enterprise Server 11 SP1 for VMware (noarch):
- postgresql-init-9.1-0.6.10.1
- SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 8.3.20]:
- postgresql-8.3.20-0.4.1
- postgresql-contrib-8.3.20-0.4.1
- postgresql-docs-8.3.20-0.4.1
- postgresql-server-8.3.20-0.4.1
- SUSE Linux Enterprise Server 11 SP1 (noarch):
- postgresql-init-9.1-0.6.10.1
- SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 8.3.20]:
- postgresql-8.3.20-0.4.1
- SUSE Linux Enterprise Desktop 11 SP2 (noarch):
- postgresql-init-9.1-0.6.10.1
- SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 8.3.20]:
- postgresql-8.3.20-0.4.1
- SUSE Linux Enterprise Desktop 11 SP1 (noarch):
- postgresql-init-9.1-0.6.10.1