rpm/postgresql14
SHA256
1
0
Fork 0
forked from pool/postgresql14
Code Pull Requests Activity

CVE-2024-4317

Browse Source 
OBS-URL: https://build.opensuse.org/package/show/server:database:postgresql/postgresql14?expand=0&rev=68
This commit is contained in:
Marcus Rückert
2024-05-09 14:13:31 +00:00
committed by Git OBS Bridge
parent 2801a6304c
commit 393de042f2
6 changed files with 30 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
postgresql14.changes
View File

@@ -1,3 +1,28 @@
-------------------------------------------------------------------
Thu May 9 14:07:26 UTC 2024 - Marcus Rueckert <mrueckert@suse.de>
- Upgrade to 14.12:
CVE-2024-4317: Restrict visibility of pg_stats_ext and
pg_stats_ext_exprs entries to the table owner
Missing authorization in PostgreSQL built-in views pg_stats_ext
and pg_stats_ext_exprs allows an unprivileged database user to
read most common values and other statistics from CREATE
STATISTICS commands of other users. The most common values may
reveal column values the eavesdropper could not otherwise read or
results of functions they cannot execute.
This fix only fixes fresh PostgreSQL installations, namely those
that are created with the initdb utility after this fix is
applied. If you have a current PostgreSQL installation and are
concerned about this issue, please follow the instructions in the
"Updating" section on this link:
https://www.postgresql.org/about/news/postgresql-163-157-1412-1315-and-1219-released-2858/
The SQL file is in /usr/share/postgresql14/fix-CVE-2024-4317.sql
https://www.postgresql.org/docs/release/14.12/
-------------------------------------------------------------------
Wed May 1 15:24:39 UTC 2024 - Aaron Puchert <aaronpuchert@alice-dsl.net>