Alerts This Week
Warning Icon 1 681
Alerts This Week
Warning Icon 1 681

Mageia: 2019-0189 Moderate: PostgreSQL Security Issues Fix

mageia
Calendar Grey June 10, 2019
Dist Mageia Esm H88
MGASA-2020-0321 highlights MySQL upgrades addressing data exposure and authentication circumvention flaws, enhancing overall safety.
Updated postgresql packages fix security vulnerabilities CVE-2019-10129: Memory disclosure in partition routing Prior to this release, a user running PostgreSQL 11 can read arbitr...

Summary

Updated postgresql packages fix security vulnerabilities
CVE-2019-10129: Memory disclosure in partition routing Prior to this release, a user running PostgreSQL 11 can read arbitrary bytes of server memory by executing a purpose-crafted INSERT statement to a partitioned table.
CVE-2019-10130: Selectivity estimators bypass row security policies PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user able to execute SQL queries with permissions to read a given column could craft a leaky operator that could read whatever data had been sampled from that column. If this happened to include values from rows that the user is forbidden to see by a row security policy, the user could effectively bypass the policy. This is fixed by only allowing a non-leakproof operator to use this data if there are no relevant row security policies for the table.

References

- https://bugs.mageia.org/show_bug.cgi?id=24798

- https://www.cve.org/CVERecord?id=CVE-2019-10129

- https://www.cve.org/CVERecord?id=CVE-2019-10130

Resolution

SRPMS

- 6/core/postgresql9.4-9.4.22-1.mga6

- 6/core/postgresql9.6-9.6.13-3.mga6

Publication date: 10 Jun 2019
URL: https://advisories.mageia.org/MGASA-2019-0189.html
Type: security
CVE: CVE-2019-10129, CVE-2019-10130

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here