advisories/27110.adv

type: security
subject: Updated postgresql packages fix security vulnerabilities
CVE:
 - CVE-2020-14349
 - CVE-2020-14350
src:
  7:
   core:
     - postgresql9.6-9.6.19-1.mga7
     - postgresql11-11.9-1.mga7
description: |
  It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14
  did not properly sanitize the search_path during logical replication. An
  authenticated attacker could use this flaw in an attack similar to
  CVE-2018-1058, in order to execute arbitrary SQL command in the context of
  the user used for replication. (CVE-2020-14349)
  
  It was found that some PostgreSQL extensions did not use search_path safely
  in their installation script. An attacker with sufficient privileges could
  use this flaw to trick an administrator into executing a specially crafted
  script, during the installation or update of such extension. This affects
  PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19,
  and before 9.5.23. (CVE-2020-14350)
references:
 - https://bugs.mageia.org/show_bug.cgi?id=27110
 - https://www.postgresql.org/about/news/2060/
ID: MGASA-2020-0365
1	type: security
2	subject: Updated postgresql packages fix security vulnerabilities
3	CVE:
4	- CVE-2020-14349
5	- CVE-2020-14350
6	src:
7	7:
8	core:
9	- postgresql9.6-9.6.19-1.mga7
10	- postgresql11-11.9-1.mga7
11	description: \|
12	It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14
13	did not properly sanitize the search_path during logical replication. An
14	authenticated attacker could use this flaw in an attack similar to
15	CVE-2018-1058, in order to execute arbitrary SQL command in the context of
16	the user used for replication. (CVE-2020-14349)
17
18	It was found that some PostgreSQL extensions did not use search_path safely
19	in their installation script. An attacker with sufficient privileges could
20	use this flaw to trick an administrator into executing a specially crafted
21	script, during the installation or update of such extension. This affects
22	PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19,
23	and before 9.5.23. (CVE-2020-14350)
24	references:
25	- https://bugs.mageia.org/show_bug.cgi?id=27110
26	- https://www.postgresql.org/about/news/2060/
27	ID: MGASA-2020-0365