Lucene search
Copyright (C) 2021 Greenbone AGOPENVAS:13614125623114202134811HistoryOct 21, 2021 - 12:00 a.m.
SUSE: Security Advisory (SUSE-SU-2021:3481-1)
2021-10-2100:00:00
Copyright (C) 2021 Greenbone AG
plugins.openvas.org
10
suse soft-postgresql sles12sp2 cve-2021-32027 cve-2021-32028 security_update integer_overflows junk_columns warning_messages.
CVSS2
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
7.8
Confidence
High
EPSS
0.007
Percentile
80.4%
The remote host is missing an update for the
# SPDX-FileCopyrightText: 2021 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.1.4.2021.3481.1");
script_cve_id("CVE-2021-32027", "CVE-2021-32028");
script_tag(name:"creation_date", value:"2021-10-21 06:38:29 +0000 (Thu, 21 Oct 2021)");
script_version("2024-02-02T14:37:50+0000");
script_tag(name:"last_modification", value:"2024-02-02 14:37:50 +0000 (Fri, 02 Feb 2024)");
script_tag(name:"cvss_base", value:"6.5");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:S/C:P/I:P/A:P");
script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2021-06-10 13:54:44 +0000 (Thu, 10 Jun 2021)");
script_name("SUSE: Security Advisory (SUSE-SU-2021:3481-1)");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2021 Greenbone AG");
script_family("SuSE Local Security Checks");
script_dependencies("gather-package-list.nasl");
script_mandatory_keys("ssh/login/suse_sles", "ssh/login/rpms", re:"ssh/login/release=(SLES12\.0SP2|SLES12\.0SP3|SLES12\.0SP4|SLES12\.0SP5)");
script_xref(name:"Advisory-ID", value:"SUSE-SU-2021:3481-1");
script_xref(name:"URL", value:"https://www.suse.com/support/update/announcement/2021/suse-su-20213481-1/");
script_tag(name:"summary", value:"The remote host is missing an update for the 'postgresql10' package(s) announced via the SUSE-SU-2021:3481-1 advisory.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");
script_tag(name:"insight", value:"This update for postgresql10 fixes the following issues:
Fix for build with llvm12 on s390x. (bsc#1185952)
Re-enable 'icu' for PostgreSQL 10. (bsc#1179945)
Add postgresqlXX-server-devel as a dependency for
postgresql13-server-devel. (bsc#1187751)
Upgrade to version 10.18. (bsc#1190177)
Upgrade to version 10.17 (already released for SUSE Linux Enterprise 12 SP5):
CVE-2021-32027: Fixed integer overflows in array subscripting
calculations (bsc#1185924).
CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON
CONFLICT ... UPDATE target lists (bsc#1185925).
Don't use %_stop_on_removal, because it was meant to be private and got
removed from openSUSE. %_restart_on_update is also private, but still
supported and needed for now (bsc#1183168).
Re-enable build of the llvmjit subpackage on SLE, but it will only be
delivered on PackageHub for now (bsc#1183118).
Disable icu for PostgreSQL 10 (and older) on TW (bsc#1179945).
Fixed an issue dropping irregular warning messages by removing the
package. (bsc#1178961)
Fixed an issue when build does not build the requiements to avoid
dangling symlinks in the devel package. (bsc#1179765)
Fix recently-added timetz test case so it works when the USA is not
observing daylight savings time.");
script_tag(name:"affected", value:"'postgresql10' package(s) on SUSE Linux Enterprise Server 12-SP2, SUSE Linux Enterprise Server 12-SP3, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9.");
script_tag(name:"solution", value:"Please install the updated package(s).");
script_tag(name:"solution_type", value:"VendorFix");
script_tag(name:"qod_type", value:"package");
exit(0);
}
include("revisions-lib.inc");
include("pkg-lib-rpm.inc");
release = rpm_get_ssh_release();
if(!release)
exit(0);
res = "";
report = "";
if(release == "SLES12.0SP2") {
if(!isnull(res = isrpmvuln(pkg:"postgresql10", rpm:"postgresql10~10.18~4.19.6", rls:"SLES12.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-contrib", rpm:"postgresql10-contrib~10.18~4.19.6", rls:"SLES12.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-contrib-debuginfo", rpm:"postgresql10-contrib-debuginfo~10.18~4.19.6", rls:"SLES12.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-debuginfo", rpm:"postgresql10-debuginfo~10.18~4.19.6", rls:"SLES12.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-debugsource", rpm:"postgresql10-debugsource~10.18~4.19.6", rls:"SLES12.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-docs", rpm:"postgresql10-docs~10.18~4.19.6", rls:"SLES12.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plperl", rpm:"postgresql10-plperl~10.18~4.19.6", rls:"SLES12.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plperl-debuginfo", rpm:"postgresql10-plperl-debuginfo~10.18~4.19.6", rls:"SLES12.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plpython", rpm:"postgresql10-plpython~10.18~4.19.6", rls:"SLES12.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plpython-debuginfo", rpm:"postgresql10-plpython-debuginfo~10.18~4.19.6", rls:"SLES12.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-pltcl", rpm:"postgresql10-pltcl~10.18~4.19.6", rls:"SLES12.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-pltcl-debuginfo", rpm:"postgresql10-pltcl-debuginfo~10.18~4.19.6", rls:"SLES12.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-server", rpm:"postgresql10-server~10.18~4.19.6", rls:"SLES12.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-server-debuginfo", rpm:"postgresql10-server-debuginfo~10.18~4.19.6", rls:"SLES12.0SP2"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
if(release == "SLES12.0SP3") {
if(!isnull(res = isrpmvuln(pkg:"postgresql10", rpm:"postgresql10~10.18~4.19.6", rls:"SLES12.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-contrib", rpm:"postgresql10-contrib~10.18~4.19.6", rls:"SLES12.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-contrib-debuginfo", rpm:"postgresql10-contrib-debuginfo~10.18~4.19.6", rls:"SLES12.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-debuginfo", rpm:"postgresql10-debuginfo~10.18~4.19.6", rls:"SLES12.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-debugsource", rpm:"postgresql10-debugsource~10.18~4.19.6", rls:"SLES12.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-docs", rpm:"postgresql10-docs~10.18~4.19.6", rls:"SLES12.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plperl", rpm:"postgresql10-plperl~10.18~4.19.6", rls:"SLES12.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plperl-debuginfo", rpm:"postgresql10-plperl-debuginfo~10.18~4.19.6", rls:"SLES12.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plpython", rpm:"postgresql10-plpython~10.18~4.19.6", rls:"SLES12.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plpython-debuginfo", rpm:"postgresql10-plpython-debuginfo~10.18~4.19.6", rls:"SLES12.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-pltcl", rpm:"postgresql10-pltcl~10.18~4.19.6", rls:"SLES12.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-pltcl-debuginfo", rpm:"postgresql10-pltcl-debuginfo~10.18~4.19.6", rls:"SLES12.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-server", rpm:"postgresql10-server~10.18~4.19.6", rls:"SLES12.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-server-debuginfo", rpm:"postgresql10-server-debuginfo~10.18~4.19.6", rls:"SLES12.0SP3"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
if(release == "SLES12.0SP4") {
if(!isnull(res = isrpmvuln(pkg:"postgresql10", rpm:"postgresql10~10.18~4.19.6", rls:"SLES12.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-contrib", rpm:"postgresql10-contrib~10.18~4.19.6", rls:"SLES12.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-contrib-debuginfo", rpm:"postgresql10-contrib-debuginfo~10.18~4.19.6", rls:"SLES12.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-debuginfo", rpm:"postgresql10-debuginfo~10.18~4.19.6", rls:"SLES12.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-debugsource", rpm:"postgresql10-debugsource~10.18~4.19.6", rls:"SLES12.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-docs", rpm:"postgresql10-docs~10.18~4.19.6", rls:"SLES12.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plperl", rpm:"postgresql10-plperl~10.18~4.19.6", rls:"SLES12.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plperl-debuginfo", rpm:"postgresql10-plperl-debuginfo~10.18~4.19.6", rls:"SLES12.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plpython", rpm:"postgresql10-plpython~10.18~4.19.6", rls:"SLES12.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plpython-debuginfo", rpm:"postgresql10-plpython-debuginfo~10.18~4.19.6", rls:"SLES12.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-pltcl", rpm:"postgresql10-pltcl~10.18~4.19.6", rls:"SLES12.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-pltcl-debuginfo", rpm:"postgresql10-pltcl-debuginfo~10.18~4.19.6", rls:"SLES12.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-server", rpm:"postgresql10-server~10.18~4.19.6", rls:"SLES12.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-server-debuginfo", rpm:"postgresql10-server-debuginfo~10.18~4.19.6", rls:"SLES12.0SP4"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
if(release == "SLES12.0SP5") {
if(!isnull(res = isrpmvuln(pkg:"postgresql10", rpm:"postgresql10~10.18~4.19.6", rls:"SLES12.0SP5"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-contrib", rpm:"postgresql10-contrib~10.18~4.19.6", rls:"SLES12.0SP5"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-contrib-debuginfo", rpm:"postgresql10-contrib-debuginfo~10.18~4.19.6", rls:"SLES12.0SP5"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-debuginfo", rpm:"postgresql10-debuginfo~10.18~4.19.6", rls:"SLES12.0SP5"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-debugsource", rpm:"postgresql10-debugsource~10.18~4.19.6", rls:"SLES12.0SP5"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-docs", rpm:"postgresql10-docs~10.18~4.19.6", rls:"SLES12.0SP5"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plperl", rpm:"postgresql10-plperl~10.18~4.19.6", rls:"SLES12.0SP5"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plperl-debuginfo", rpm:"postgresql10-plperl-debuginfo~10.18~4.19.6", rls:"SLES12.0SP5"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plpython", rpm:"postgresql10-plpython~10.18~4.19.6", rls:"SLES12.0SP5"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-plpython-debuginfo", rpm:"postgresql10-plpython-debuginfo~10.18~4.19.6", rls:"SLES12.0SP5"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-pltcl", rpm:"postgresql10-pltcl~10.18~4.19.6", rls:"SLES12.0SP5"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-pltcl-debuginfo", rpm:"postgresql10-pltcl-debuginfo~10.18~4.19.6", rls:"SLES12.0SP5"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-server", rpm:"postgresql10-server~10.18~4.19.6", rls:"SLES12.0SP5"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"postgresql10-server-debuginfo", rpm:"postgresql10-server-debuginfo~10.18~4.19.6", rls:"SLES12.0SP5"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
exit(0);
Related
nessus
nessus
RHEL 8 : postgresql:10 (RHSA-2021:2392)
2021-06-16 00:00:00
SUSE SLED12 / SLES12 Security Update : postgresql10 (SUSE-SU-2021:3481-1)
2021-10-21 00:00:00
Oracle Linux 8 : postgresql:9.6 (ELSA-2021-2360)
2021-06-10 00:00:00
openvas
openvas
openSUSE: Security Advisory for postgresql10 (openSUSE-SU-2021:1970-1)
2021-07-13 00:00:00
SUSE: Security Advisory (SUSE-SU-2021:2777-1)
2021-08-20 00:00:00
Debian: Security Advisory (DLA-2662-1)
2021-05-16 00:00:00
rocky
rocky
postgresql:10 security update
2021-06-09 11:21:16
postgresql:9.6 security update
2021-06-09 11:21:04
postgresql:13 security update
2021-06-10 09:54:30
redhat
redhat
(RHSA-2021:2390) Important: postgresql:10 security update
2021-06-14 07:20:08
(RHSA-2021:2393) Important: postgresql:9.6 security update
2021-06-14 07:20:43
(RHSA-2021:2360) Important: postgresql:9.6 security update
2021-06-09 11:21:04
almalinux
almalinux
Important: postgresql:9.6 security update
2021-06-09 11:21:04
Important: postgresql:10 security update
2021-06-09 11:21:16
Important: postgresql:13 security update
2021-06-10 09:54:30
ics
ics
Hitachi Energy MicroSCADA X DMS600
2022-10-25 12:00:00
altlinux
altlinux
oraclelinux
oraclelinux
postgresql:10 security update
2021-06-10 00:00:00
rh-postgresql10-postgresql security update
2021-08-23 00:00:00
postgresql:9.6 security update
2021-06-10 00:00:00
osv
osv
postgresql-9.6 - security update
2021-05-15 00:00:00
Important: postgresql:9.6 security update
2021-06-09 11:21:04
Important: postgresql:9.6 security update
2021-06-09 11:21:04
freebsd
freebsd
PostgreSQL server -- two security issues
2021-05-13 00:00:00
suse
suse
Security update for postgresql10 (moderate)
2021-07-11 00:00:00
Security update for postgresql10 (moderate)
2021-06-18 00:00:00
Security update for postgresql13 (moderate)
2021-07-11 00:00:00
debian
debian
[SECURITY] [DLA 2662-1] postgresql-9.6 security update
2021-05-15 06:35:07
[SECURITY] [DSA 4915-1] postgresql-11 security update
2021-05-13 17:39:06
ibm
ibm
redos
redos
mageia
mageia
Updated postgresql packages fix security vulnerabilities
2021-05-23 21:45:17
archlinux
archlinux
[ASA-202106-15] postgresql: multiple issues
2021-06-01 00:00:00
ubuntu
ubuntu
PostgreSQL vulnerabilities
2021-06-01 00:00:00
kaspersky
kaspersky
KLA12177 Multiple vulnerabilities in PostgreSQL
2021-05-13 00:00:00
cve
cve
CVE-2021-32027
2021-06-01 14:15:09
CVE-2021-32028
2021-10-11 17:15:07
veracode
veracode
Denial Of Service (DoS)
2021-05-14 22:08:11
Information Disclosure
2021-05-14 22:08:05
alpinelinux
alpinelinux
CVE-2021-32028
2021-10-11 17:15:07
CVE-2021-32027
2021-06-01 14:15:09
ubuntucve
ubuntucve
CVE-2021-32028
2021-05-13 00:00:00
CVE-2021-32027
2021-05-14 00:00:00
postgresql
postgresql
Vulnerability in core server (CVE-2021-32028)
2021-10-11 17:15:00
Vulnerability in core server (CVE-2021-32027)
2021-06-01 14:15:00
debiancve
debiancve
CVE-2021-32028
2021-10-11 17:15:07
CVE-2021-32027
2021-06-01 14:15:09
cvelist
cvelist
CVE-2021-32028
2021-10-11 00:00:00
CVE-2021-32027
2021-06-01 00:00:00
nvd
nvd
CVE-2021-32028
2021-10-11 17:15:07
CVE-2021-32027
2021-06-01 14:15:09
redhatcve
redhatcve
CVE-2021-32027
2021-05-19 00:27:47
CVE-2021-32028
2021-05-20 14:13:02
prion
prion
Design/Logic Flaw
2021-10-11 17:15:00
Out-of-bounds
2021-06-01 14:15:00
cbl_mariner
cbl_mariner
CVE-2021-32027 affecting package postgresql 12.6-1
2021-06-20 03:47:42
amazon
amazon
Important: postgresql96
2021-07-08 18:38:00
gentoo
gentoo
PostgreSQL: Multiple Vulnerabilities
2022-11-19 00:00:00
CVSS2
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
7.8
Confidence
High
EPSS
0.007
Percentile
80.4%
Related for OPENVAS:13614125623114202134811