This update for postgresql12 fixes the following issues :

  - Upgrade to version 12.5 :

  - CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ...
    WITH HOLD and firing of deferred triggers within index     expressions and materialized view queries.

  - CVE-2020-25694, bsc#1178667: a) Fix usage of complex     connection-string parameters in pg_dump, pg_restore,     clusterdb, reindexdb, and vacuumdb. b) When psql's     \connect command re-uses connection parameters, ensure     that all non-overridden parameters from a previous     connection string are re-used.

  - CVE-2020-25696, bsc#1178668: Prevent psql's \gset     command from modifying specially-treated variables.

  - Fix recently-added timetz test case so it works when the     USA is not observing daylight savings time.

  - https://www.postgresql.org/about/news/2111/

  - https://www.postgresql.org/docs/12/release-12-5.html

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5401 advisory.

    The libpq package provides the PostgreSQL client library, which allows client programs to connect to     PostgreSQL servers.

    The following packages have been upgraded to a later upstream version: libpq (12.5). (BZ#1898228,     BZ#1901558)

    Security Fix(es):

    * postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

    * postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-55671 advisory.

    [10.15-1]
    - Rebase to upstream release 10.15       Resolves: rhbz#1898213       Resolves: rhbz#1898341       Resolves: rhbz#1901567

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0057 advisory.

    The libpq package provides the PostgreSQL client library, which allows client programs to connect to     PostgreSQL servers.

    The following packages have been upgraded to a later upstream version: libpq (12.5). (BZ#1898227,     BZ#1901559)

    Security Fix(es):

    * postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

    * postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0161 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (10.15).

    Security Fix(es):

    * postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

    * postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

    * postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0167 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (9.6.20).

    Security Fix(es):

    * postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

    * postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

    * postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution (CVE-2019-10208)

    * postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

    * postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

    * postgresql: Selectivity estimators bypass row security policies (CVE-2019-10130)

    * postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for postgresql, postgresql12, postgresql13 fixes the following issues :

Initial packaging of PostgreSQL 13 :

https://www.postgresql.org/about/news/2077/

https://www.postgresql.org/docs/13/release-13.html

Changes in postgresql :

Bump postgresql major version to 13.

Changes in postgresql12 :

%ghost the symlinks to pg_config and ecpg. (bsc#1178961)

BuildRequire libpq5 and libecpg6 when not building them to avoid dangling symlinks in the devel package. (bsc#1179765)

Fix a DST problem in the test suite.

Changes in postgresql13 :

Add postgresql-icu68.patch: fix build with ICU 68

%ghost the symlinks to pg_config and ecpg. (bsc#1178961)

BuildRequire libpq5 and libecpg6 when not building them to avoid dangling symlinks in the devel package. (bsc#1179765)

Upgrade to version 13.1 :

CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries.

CVE-2020-25694, bsc#1178667: a) Fix usage of complex connection-string parameters in pg_dump, pg_restore, clusterdb, reindexdb, and vacuumdb.
b) When psql's \connect command re-uses connection parameters, ensure that all non-overridden parameters from a previous connection string are re-used.

CVE-2020-25696, bsc#1178668: Prevent psql's \gset command from modifying specially-treated variables.

Fix recently-added timetz test case so it works when the USA is not observing daylight savings time. (obsoletes postgresql-timetz.patch)

https://www.postgresql.org/about/news/2111/

https://www.postgresql.org/docs/13/release-13-1.html

Fix a DST problem in the test suite.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0017 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2020-14349:
    It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize     the search_path during logical replication. An authenticated attacker could use this flaw in an attack     similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for     replication.

    CVE-2020-14350:
    It was found that some PostgreSQL extensions did not use search_path safely in their installation script.
    An attacker with sufficient privileges could use this flaw to trick an administrator into executing a     specially crafted script, during the installation or update of such extension. This affects PostgreSQL     versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.

    CVE-2020-1720:
    A flaw was found in PostgreSQL's ALTER ... DEPENDS ON EXTENSION, where sub-commands did not perform     authorization checks. An authenticated attacker could use this flaw in certain configurations to perform     drop objects such as function, triggers, et al., leading to database corruption. This issue affects     PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.

    CVE-2020-25694:
    A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.

    CVE-2020-25695:
    A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability.

    CVE-2020-25696:
    A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5,     before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset     when querying a compromised server, the attacker can execute arbitrary code as the operating system     account running psql. The highest threat from this vulnerability is to data confidentiality and integrity     as well as system availability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2020_5620 advisory.

    * postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

    * postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

    * postgresql: Uncontrolled search path element in logical replication (CVE-2020-14349)

    * postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

    * postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

    * postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0478 advisory.

    This advisory aggregates security fixes for the postgresql SRPM in CIQ LTS 9.2. It addresses 34 CVEs:
    CVE-2007-0555, CVE-2025-8714, CVE-2012-2655, CVE-2007-6067, CVE-2012-0867, and 29 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
143343	openSUSE Security Update : postgresql12 (openSUSE-2020-2018)	Nessus	SuSE Local Security Checks	2020/11/30	2024/2/7	high
144204	RHEL 8 : libpq (RHSA-2020:5401)	Nessus	Red Hat Local Security Checks	2020/12/14	2024/11/7	high
144561	Oracle Linux 8 : ELSA-2020-5567-1: / postgresql:10 (ELSA-2020-55671)	Nessus	Oracle Linux Local Security Checks	2020/12/23	2024/10/22	high
144850	RHEL 8 : libpq (RHSA-2021:0057)	Nessus	Red Hat Local Security Checks	2021/1/11	2024/11/7	high
145042	RHEL 8 : postgresql:10 (RHSA-2021:0161)	Nessus	Red Hat Local Security Checks	2021/1/18	2024/11/7	high
145227	RHEL 8 : postgresql:9.6 (RHSA-2021:0167)	Nessus	Red Hat Local Security Checks	2021/1/20	2024/11/7	high
145490	SUSE SLES12 Security Update : postgresql, postgresql12, postgresql13 (SUSE-SU-2021:0217-1)	Nessus	SuSE Local Security Checks	2021/1/27	2022/5/11	high
236609	Alibaba Cloud Linux 3 : 0017: postgresql:12 (ALINUX3-SA-2021:0017)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
357630	Rocky Linux 8 [CIQ] Security Update: pgaudit / pgaudit-debuginfo / pgaudit-debugsource / etc Multiple Vulnerabilities (crlsa-2020_5620)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
356309	Rocky Linux 9.2 [CIQ] Security Update: postgresql / postgresql-contrib / postgresql-contrib-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0478)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high

high