MGASA-2019-0225 - Updated postgresql packages fix security vulnerabilities

Publication date: 18 Aug 2019
URL: https://advisories.mageia.org/MGASA-2019-0225.html
Type: security
Affected Mageia releases: 6, 7
CVE: CVE-2019-10208,
     CVE-2019-10209

Updated postgresql packages fix security vulnerabilities:

Given a suitable SECURITY DEFINER function, an attacker can execute
arbitrary SQL under the identity of the function owner. An attack requires
EXECUTE permission on the function, which must itself contain a function
call having inexact argument type match. For example, length('foo'::varchar)
and length('foo') are inexact, while length('foo'::text) is exact
(CVE-2019-10208).

In a database containing hypothetical, user-defined hash equality operators,
an attacker could read arbitrary bytes of server memory. For an attack to
become possible, a superuser would need to create unusual operators. It is
possible for operators not purpose-crafted for attack to have the properties
that enable an attack, but we are not aware of specific examples
(CVE-2019-10209).

This update also fixes over 40 bugs that were reported in the last several
months.  See the upstream release notes for details.

References:
- https://bugs.mageia.org/show_bug.cgi?id=25260
- https://www.postgresql.org/docs/9.4/release-9-4-24.html
- https://www.postgresql.org/docs/9.6/release-9-6-15.html
- https://www.postgresql.org/docs/11/release-11-5.html
- https://www.postgresql.org/about/news/postgresql-115-1010-9615-9519-9424-and-12-beta-3-released-1960/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10208
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10209

SRPMS:
- 7/core/postgresql9.6-9.6.15-1.mga7
- 7/core/postgresql11-11.5-1.mga7
- 6/core/postgresql9.4-9.4.24-1.mga6
- 6/core/postgresql9.6-9.6.15-1.mga6