* bsc#1229013 Cross-References: * CVE-2024-7348 . # Security update for postgresql16 Announcement ID: SUSE-SU-2024:3158-3 Release Date: 2024-10-02T15:11:48Z Rating: important References: * bsc#1229013 Cross-References: * CVE-2024-7348 CVSS scores: * CVE-2024-7348 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-7348 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-7348 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * Legacy Module 15-SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves one vulnerability can now be installed. ## Description: This update for postgresql16 fixes the following issues: * Upgrade to 15.8 (bsc#1229013) * CVE-2024-7348: PostgreSQL relation replacement during pg_dump executes arbitrary SQL. (bsc#1229013) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Legacy Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Legacy-15-SP6-2024-3158=1 ## Package List: * Legacy Module 15-SP6 (aarch64 ppc64le s390x x86_64) * postgresql15-server-devel-15.8-150600.16.6.1 * postgresql15-contrib-15.8-150600.16.6.1 * postgresql15-pltcl-debuginfo-15.8-150600.16.6.1 * postgresql15-pltcl-15.8-150600.16.6.1 * postgresql15-server-devel-debuginfo-15.8-150600.16.6.1 * postgresql15-devel-debuginfo-15.8-150600.16.6.1 * postgresql15-debuginfo-15.8-150600.16.6.1 * postgresql15-plpython-debuginfo-15.8-150600.16.6.1 * postgresql15-server-debuginfo-15.8-150600.16.6.1 * postgresql15-plpython-15.8-150600.16.6.1 * postgresql15-devel-15.8-150600.16.6.1 * postgresql15-15.8-150600.16.6.1 * postgresql15-server-15.8-150600.16.6.1 * postgresql15-contrib-debuginfo-15.8-150600.16.6.1 *postgresql15-plperl-debuginfo-15.8-150600.16.6.1 * postgresql15-debugsource-15.8-150600.16.6.1 * postgresql15-plperl-15.8-150600.16.6.1 * Legacy Module 15-SP6 (noarch) * postgresql15-docs-15.8-150600.16.6.1 ## References: * https://www.suse.com/security/cve/CVE-2024-7348.html * https://bugzilla.suse.com/show_bug.cgi?id=1229013 . Critical PostgreSQL 16 security update for SUSE users. Implement patch to fix SQL execution vulnerabilities, enhancing overall system protection.. postgresql16 security advisory, SQL execution risk, SUSE update, database security notification, system patch details. . Severity: Important. LinuxSecurity.com Team
Several local vulnerabilities have been discovered in PostgreSQL, an object-relational SQL database. The Common Vulnerabilities and Exposures project identifies the following problems: . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2418-1
Get the latest Linux and open source security news straight to your inbox.