SUSE SLES15 / openSUSE 15 Security Update : postgresql12 (SUSE-SU-2023:4454-1)

high Nessus Plugin ID 185938

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4454-1 advisory.

- PostgreSQL Project reports: Certain aggregate function calls receiving unknown-type arguments could disclose bytes of server memory from the end of the unknown-type value to the next zero byte. One typically gets an unknown-type value via a string literal having no type designation. We have not confirmed or ruled out viability of attacks that arrange for presence of notable, confidential information in disclosed bytes.
(CVE-2023-5868)

- PostgreSQL Project reports: While modifying certain SQL array values, missing overflow checks let authenticated database users write arbitrary bytes to a memory area that facilitates arbitrary code execution. Missing overflow checks also let authenticated database users read a wide area of server memory. The CVE-2021-32027 fix covered some attacks of this description, but it missed others. (CVE-2023-5869)

- PostgreSQL Project reports: Documentation says the pg_cancel_backend role cannot signal a backend owned by a superuser. On the contrary, it can signal background workers, including the logical replication launcher. It can signal autovacuum workers and the autovacuum launcher. Signaling autovacuum workers and those two launchers provides no meaningful exploit, so exploiting this vulnerability requires a non-core extension with a less-resilient background worker. For example, a non-core background worker that does not auto-restart would experience a denial of service with respect to that particular background worker. (CVE-2023-5870)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 185938

File Name: suse_SU-2023-4454-1.nasl

Version: 1.2

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/17/2023

Updated: 2/16/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-5869

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:postgresql12-plpython, p-cpe:/a:novell:suse_linux:postgresql12-server-devel, p-cpe:/a:novell:suse_linux:postgresql12-devel, p-cpe:/a:novell:suse_linux:postgresql12-plperl, p-cpe:/a:novell:suse_linux:postgresql12, p-cpe:/a:novell:suse_linux:postgresql12-docs, p-cpe:/a:novell:suse_linux:postgresql12-pltcl, p-cpe:/a:novell:suse_linux:postgresql12-contrib, p-cpe:/a:novell:suse_linux:postgresql12-server, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/16/2023

Vulnerability Publication Date: 11/9/2023

Reference Information

CVE: CVE-2023-5868, CVE-2023-5869, CVE-2023-5870

IAVB: 2023-B-0088-S

SuSE: SUSE-SU-2023:4454-1

Detections

Analytics