[SECURITY] [DLA 2331-1] posgresql-9.6 security update

2020-08-1708:24:00

lists.debian.org

4.4 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

7.3 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.3%

JSON

Debian LTS Advisory DLA-2331-1 [email protected]
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
August 17, 2020 https://wiki.debian.org/LTS

Package : posgresql-9.6
Version : 9.6.19-0+deb9u1
CVE ID : CVE-2020-14350

Andres Freund found an issue in the PostgreSQL database system where an
uncontrolled search path could allow users to run arbitrary SQL functions
with elevated priviledges when a superuser runs certain `CREATE EXTENSION'
statements.

For Debian 9 stretch, this problem has been fixed in version
9.6.19-0+deb9u1.

We recommend that you upgrade your posgresql-9.6 packages.

For the detailed security status of posgresql-9.6 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/posgresql-9.6

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10amd64postgresql-plpython3-11< 11.9-0+deb10u1postgresql-plpython3-11_11.9-0+deb10u1_amd64.deb
Debian10amd64libecpg-compat3-dbgsym< 11.9-0+deb10u1libecpg-compat3-dbgsym_11.9-0+deb10u1_amd64.deb
Debian10armhflibecpg6-dbgsym< 11.9-0+deb10u1libecpg6-dbgsym_11.9-0+deb10u1_armhf.deb
Debian10ppc64ellibpq-dev< 11.9-0+deb10u1libpq-dev_11.9-0+deb10u1_ppc64el.deb
Debian10armelpostgresql-client-11< 11.9-0+deb10u1postgresql-client-11_11.9-0+deb10u1_armel.deb
Debian9amd64postgresql-pltcl-9.6< 9.6.19-0+deb9u1postgresql-pltcl-9.6_9.6.19-0+deb9u1_amd64.deb
Debian9armellibecpg6< 9.6.19-0+deb9u1libecpg6_9.6.19-0+deb9u1_armel.deb
Debian10ppc64elpostgresql-plperl-11-dbgsym< 11.9-0+deb10u1postgresql-plperl-11-dbgsym_11.9-0+deb10u1_ppc64el.deb
Debian10mipspostgresql-pltcl-11< 11.9-0+deb10u1postgresql-pltcl-11_11.9-0+deb10u1_mips.deb
Debian9armhfpostgresql-server-dev-9.6< 9.6.19-0+deb9u1postgresql-server-dev-9.6_9.6.19-0+deb9u1_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	amd64	postgresql-plpython3-11	< 11.9-0+deb10u1	postgresql-plpython3-11_11.9-0+deb10u1_amd64.deb
Debian	10	amd64	libecpg-compat3-dbgsym	< 11.9-0+deb10u1	libecpg-compat3-dbgsym_11.9-0+deb10u1_amd64.deb
Debian	10	armhf	libecpg6-dbgsym	< 11.9-0+deb10u1	libecpg6-dbgsym_11.9-0+deb10u1_armhf.deb
Debian	10	ppc64el	libpq-dev	< 11.9-0+deb10u1	libpq-dev_11.9-0+deb10u1_ppc64el.deb
Debian	10	armel	postgresql-client-11	< 11.9-0+deb10u1	postgresql-client-11_11.9-0+deb10u1_armel.deb
Debian	9	amd64	postgresql-pltcl-9.6	< 9.6.19-0+deb9u1	postgresql-pltcl-9.6_9.6.19-0+deb9u1_amd64.deb
Debian	9	armel	libecpg6	< 9.6.19-0+deb9u1	libecpg6_9.6.19-0+deb9u1_armel.deb
Debian	10	ppc64el	postgresql-plperl-11-dbgsym	< 11.9-0+deb10u1	postgresql-plperl-11-dbgsym_11.9-0+deb10u1_ppc64el.deb
Debian	10	mips	postgresql-pltcl-11	< 11.9-0+deb10u1	postgresql-pltcl-11_11.9-0+deb10u1_mips.deb
Debian	9	armhf	postgresql-server-dev-9.6	< 9.6.19-0+deb9u1	postgresql-server-dev-9.6_9.6.19-0+deb9u1_armhf.deb