csaf_opensuse - opensuse-su-2024:11184-1

Vulnerability from csaf_opensuse

Published

2024-06-15 00:00

Modified

2024-06-15 00:00

Summary

postgresql10-10.18-1.3 on GA media

Notes

Title of the patch

postgresql10-10.18-1.3 on GA media

Description of the patch

These are all security issues fixed in the postgresql10-10.18-1.3 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2024-11184

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "postgresql10-10.18-1.3 on GA media",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "These are all security issues fixed in the postgresql10-10.18-1.3 package on the GA media of openSUSE Tumbleweed.",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-Tumbleweed-2024-11184",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11184-1.json",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-15098 page",
            url: "https://www.suse.com/security/cve/CVE-2017-15098/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-15099 page",
            url: "https://www.suse.com/security/cve/CVE-2017-15099/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-1052 page",
            url: "https://www.suse.com/security/cve/CVE-2018-1052/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-1053 page",
            url: "https://www.suse.com/security/cve/CVE-2018-1053/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-1058 page",
            url: "https://www.suse.com/security/cve/CVE-2018-1058/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-10915 page",
            url: "https://www.suse.com/security/cve/CVE-2018-10915/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-10925 page",
            url: "https://www.suse.com/security/cve/CVE-2018-10925/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-1115 page",
            url: "https://www.suse.com/security/cve/CVE-2018-1115/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-16850 page",
            url: "https://www.suse.com/security/cve/CVE-2018-16850/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-10130 page",
            url: "https://www.suse.com/security/cve/CVE-2019-10130/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-10164 page",
            url: "https://www.suse.com/security/cve/CVE-2019-10164/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-10208 page",
            url: "https://www.suse.com/security/cve/CVE-2019-10208/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14349 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14349/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14350 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14350/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-1720 page",
            url: "https://www.suse.com/security/cve/CVE-2020-1720/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-25694 page",
            url: "https://www.suse.com/security/cve/CVE-2020-25694/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-25695 page",
            url: "https://www.suse.com/security/cve/CVE-2020-25695/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-25696 page",
            url: "https://www.suse.com/security/cve/CVE-2020-25696/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-32027 page",
            url: "https://www.suse.com/security/cve/CVE-2021-32027/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-32028 page",
            url: "https://www.suse.com/security/cve/CVE-2021-32028/",
         },
      ],
      title: "postgresql10-10.18-1.3 on GA media",
      tracking: {
         current_release_date: "2024-06-15T00:00:00Z",
         generator: {
            date: "2024-06-15T00:00:00Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2024:11184-1",
         initial_release_date: "2024-06-15T00:00:00Z",
         revision_history: [
            {
               date: "2024-06-15T00:00:00Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "postgresql10-10.18-1.3.aarch64",
                        product: {
                           name: "postgresql10-10.18-1.3.aarch64",
                           product_id: "postgresql10-10.18-1.3.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-contrib-10.18-1.3.aarch64",
                        product: {
                           name: "postgresql10-contrib-10.18-1.3.aarch64",
                           product_id: "postgresql10-contrib-10.18-1.3.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-devel-10.18-1.3.aarch64",
                        product: {
                           name: "postgresql10-devel-10.18-1.3.aarch64",
                           product_id: "postgresql10-devel-10.18-1.3.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-docs-10.18-1.3.aarch64",
                        product: {
                           name: "postgresql10-docs-10.18-1.3.aarch64",
                           product_id: "postgresql10-docs-10.18-1.3.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-plperl-10.18-1.3.aarch64",
                        product: {
                           name: "postgresql10-plperl-10.18-1.3.aarch64",
                           product_id: "postgresql10-plperl-10.18-1.3.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-plpython-10.18-1.3.aarch64",
                        product: {
                           name: "postgresql10-plpython-10.18-1.3.aarch64",
                           product_id: "postgresql10-plpython-10.18-1.3.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-pltcl-10.18-1.3.aarch64",
                        product: {
                           name: "postgresql10-pltcl-10.18-1.3.aarch64",
                           product_id: "postgresql10-pltcl-10.18-1.3.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-server-10.18-1.3.aarch64",
                        product: {
                           name: "postgresql10-server-10.18-1.3.aarch64",
                           product_id: "postgresql10-server-10.18-1.3.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-test-10.18-1.3.aarch64",
                        product: {
                           name: "postgresql10-test-10.18-1.3.aarch64",
                           product_id: "postgresql10-test-10.18-1.3.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "postgresql10-10.18-1.3.ppc64le",
                        product: {
                           name: "postgresql10-10.18-1.3.ppc64le",
                           product_id: "postgresql10-10.18-1.3.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-contrib-10.18-1.3.ppc64le",
                        product: {
                           name: "postgresql10-contrib-10.18-1.3.ppc64le",
                           product_id: "postgresql10-contrib-10.18-1.3.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-devel-10.18-1.3.ppc64le",
                        product: {
                           name: "postgresql10-devel-10.18-1.3.ppc64le",
                           product_id: "postgresql10-devel-10.18-1.3.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-docs-10.18-1.3.ppc64le",
                        product: {
                           name: "postgresql10-docs-10.18-1.3.ppc64le",
                           product_id: "postgresql10-docs-10.18-1.3.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-plperl-10.18-1.3.ppc64le",
                        product: {
                           name: "postgresql10-plperl-10.18-1.3.ppc64le",
                           product_id: "postgresql10-plperl-10.18-1.3.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-plpython-10.18-1.3.ppc64le",
                        product: {
                           name: "postgresql10-plpython-10.18-1.3.ppc64le",
                           product_id: "postgresql10-plpython-10.18-1.3.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-pltcl-10.18-1.3.ppc64le",
                        product: {
                           name: "postgresql10-pltcl-10.18-1.3.ppc64le",
                           product_id: "postgresql10-pltcl-10.18-1.3.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-server-10.18-1.3.ppc64le",
                        product: {
                           name: "postgresql10-server-10.18-1.3.ppc64le",
                           product_id: "postgresql10-server-10.18-1.3.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-test-10.18-1.3.ppc64le",
                        product: {
                           name: "postgresql10-test-10.18-1.3.ppc64le",
                           product_id: "postgresql10-test-10.18-1.3.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "postgresql10-10.18-1.3.s390x",
                        product: {
                           name: "postgresql10-10.18-1.3.s390x",
                           product_id: "postgresql10-10.18-1.3.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-contrib-10.18-1.3.s390x",
                        product: {
                           name: "postgresql10-contrib-10.18-1.3.s390x",
                           product_id: "postgresql10-contrib-10.18-1.3.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-devel-10.18-1.3.s390x",
                        product: {
                           name: "postgresql10-devel-10.18-1.3.s390x",
                           product_id: "postgresql10-devel-10.18-1.3.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-docs-10.18-1.3.s390x",
                        product: {
                           name: "postgresql10-docs-10.18-1.3.s390x",
                           product_id: "postgresql10-docs-10.18-1.3.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-plperl-10.18-1.3.s390x",
                        product: {
                           name: "postgresql10-plperl-10.18-1.3.s390x",
                           product_id: "postgresql10-plperl-10.18-1.3.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-plpython-10.18-1.3.s390x",
                        product: {
                           name: "postgresql10-plpython-10.18-1.3.s390x",
                           product_id: "postgresql10-plpython-10.18-1.3.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-pltcl-10.18-1.3.s390x",
                        product: {
                           name: "postgresql10-pltcl-10.18-1.3.s390x",
                           product_id: "postgresql10-pltcl-10.18-1.3.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-server-10.18-1.3.s390x",
                        product: {
                           name: "postgresql10-server-10.18-1.3.s390x",
                           product_id: "postgresql10-server-10.18-1.3.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-test-10.18-1.3.s390x",
                        product: {
                           name: "postgresql10-test-10.18-1.3.s390x",
                           product_id: "postgresql10-test-10.18-1.3.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "postgresql10-10.18-1.3.x86_64",
                        product: {
                           name: "postgresql10-10.18-1.3.x86_64",
                           product_id: "postgresql10-10.18-1.3.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-contrib-10.18-1.3.x86_64",
                        product: {
                           name: "postgresql10-contrib-10.18-1.3.x86_64",
                           product_id: "postgresql10-contrib-10.18-1.3.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-devel-10.18-1.3.x86_64",
                        product: {
                           name: "postgresql10-devel-10.18-1.3.x86_64",
                           product_id: "postgresql10-devel-10.18-1.3.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-docs-10.18-1.3.x86_64",
                        product: {
                           name: "postgresql10-docs-10.18-1.3.x86_64",
                           product_id: "postgresql10-docs-10.18-1.3.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-plperl-10.18-1.3.x86_64",
                        product: {
                           name: "postgresql10-plperl-10.18-1.3.x86_64",
                           product_id: "postgresql10-plperl-10.18-1.3.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-plpython-10.18-1.3.x86_64",
                        product: {
                           name: "postgresql10-plpython-10.18-1.3.x86_64",
                           product_id: "postgresql10-plpython-10.18-1.3.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-pltcl-10.18-1.3.x86_64",
                        product: {
                           name: "postgresql10-pltcl-10.18-1.3.x86_64",
                           product_id: "postgresql10-pltcl-10.18-1.3.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-server-10.18-1.3.x86_64",
                        product: {
                           name: "postgresql10-server-10.18-1.3.x86_64",
                           product_id: "postgresql10-server-10.18-1.3.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "postgresql10-test-10.18-1.3.x86_64",
                        product: {
                           name: "postgresql10-test-10.18-1.3.x86_64",
                           product_id: "postgresql10-test-10.18-1.3.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "openSUSE Tumbleweed",
                        product: {
                           name: "openSUSE Tumbleweed",
                           product_id: "openSUSE Tumbleweed",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:tumbleweed",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-10.18-1.3.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
            },
            product_reference: "postgresql10-10.18-1.3.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-10.18-1.3.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
            },
            product_reference: "postgresql10-10.18-1.3.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-10.18-1.3.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
            },
            product_reference: "postgresql10-10.18-1.3.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-10.18-1.3.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
            },
            product_reference: "postgresql10-10.18-1.3.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-contrib-10.18-1.3.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
            },
            product_reference: "postgresql10-contrib-10.18-1.3.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-contrib-10.18-1.3.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
            },
            product_reference: "postgresql10-contrib-10.18-1.3.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-contrib-10.18-1.3.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
            },
            product_reference: "postgresql10-contrib-10.18-1.3.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-contrib-10.18-1.3.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
            },
            product_reference: "postgresql10-contrib-10.18-1.3.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-devel-10.18-1.3.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
            },
            product_reference: "postgresql10-devel-10.18-1.3.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-devel-10.18-1.3.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
            },
            product_reference: "postgresql10-devel-10.18-1.3.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-devel-10.18-1.3.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
            },
            product_reference: "postgresql10-devel-10.18-1.3.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-devel-10.18-1.3.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
            },
            product_reference: "postgresql10-devel-10.18-1.3.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-docs-10.18-1.3.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
            },
            product_reference: "postgresql10-docs-10.18-1.3.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-docs-10.18-1.3.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
            },
            product_reference: "postgresql10-docs-10.18-1.3.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-docs-10.18-1.3.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
            },
            product_reference: "postgresql10-docs-10.18-1.3.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-docs-10.18-1.3.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
            },
            product_reference: "postgresql10-docs-10.18-1.3.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-plperl-10.18-1.3.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
            },
            product_reference: "postgresql10-plperl-10.18-1.3.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-plperl-10.18-1.3.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
            },
            product_reference: "postgresql10-plperl-10.18-1.3.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-plperl-10.18-1.3.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
            },
            product_reference: "postgresql10-plperl-10.18-1.3.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-plperl-10.18-1.3.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
            },
            product_reference: "postgresql10-plperl-10.18-1.3.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-plpython-10.18-1.3.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
            },
            product_reference: "postgresql10-plpython-10.18-1.3.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-plpython-10.18-1.3.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
            },
            product_reference: "postgresql10-plpython-10.18-1.3.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-plpython-10.18-1.3.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
            },
            product_reference: "postgresql10-plpython-10.18-1.3.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-plpython-10.18-1.3.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
            },
            product_reference: "postgresql10-plpython-10.18-1.3.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-pltcl-10.18-1.3.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
            },
            product_reference: "postgresql10-pltcl-10.18-1.3.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-pltcl-10.18-1.3.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
            },
            product_reference: "postgresql10-pltcl-10.18-1.3.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-pltcl-10.18-1.3.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
            },
            product_reference: "postgresql10-pltcl-10.18-1.3.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-pltcl-10.18-1.3.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
            },
            product_reference: "postgresql10-pltcl-10.18-1.3.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-server-10.18-1.3.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
            },
            product_reference: "postgresql10-server-10.18-1.3.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-server-10.18-1.3.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
            },
            product_reference: "postgresql10-server-10.18-1.3.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-server-10.18-1.3.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
            },
            product_reference: "postgresql10-server-10.18-1.3.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-server-10.18-1.3.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
            },
            product_reference: "postgresql10-server-10.18-1.3.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-test-10.18-1.3.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
            },
            product_reference: "postgresql10-test-10.18-1.3.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-test-10.18-1.3.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
            },
            product_reference: "postgresql10-test-10.18-1.3.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-test-10.18-1.3.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
            },
            product_reference: "postgresql10-test-10.18-1.3.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "postgresql10-test-10.18-1.3.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            },
            product_reference: "postgresql10-test-10.18-1.3.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2017-15098",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-15098",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-15098",
               url: "https://www.suse.com/security/cve/CVE-2017-15098",
            },
            {
               category: "external",
               summary: "SUSE Bug 1067844 for CVE-2017-15098",
               url: "https://bugzilla.suse.com/1067844",
            },
            {
               category: "external",
               summary: "SUSE Bug 1185814 for CVE-2017-15098",
               url: "https://bugzilla.suse.com/1185814",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2017-15098",
      },
      {
         cve: "CVE-2017-15099",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-15099",
            },
         ],
         notes: [
            {
               category: "general",
               text: "INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-15099",
               url: "https://www.suse.com/security/cve/CVE-2017-15099",
            },
            {
               category: "external",
               summary: "SUSE Bug 1067841 for CVE-2017-15099",
               url: "https://bugzilla.suse.com/1067841",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2017-15099",
      },
      {
         cve: "CVE-2018-1052",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-1052",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of server memory via purpose-crafted insert to a partitioned table.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-1052",
               url: "https://www.suse.com/security/cve/CVE-2018-1052",
            },
            {
               category: "external",
               summary: "SUSE Bug 1077983 for CVE-2018-1052",
               url: "https://bugzilla.suse.com/1077983",
            },
            {
               category: "external",
               summary: "SUSE Bug 1080253 for CVE-2018-1052",
               url: "https://bugzilla.suse.com/1080253",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-1052",
      },
      {
         cve: "CVE-2018-1053",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-1053",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-1053",
               url: "https://www.suse.com/security/cve/CVE-2018-1053",
            },
            {
               category: "external",
               summary: "SUSE Bug 1077983 for CVE-2018-1053",
               url: "https://bugzilla.suse.com/1077983",
            },
            {
               category: "external",
               summary: "SUSE Bug 1185814 for CVE-2018-1053",
               url: "https://bugzilla.suse.com/1185814",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "low",
            },
         ],
         title: "CVE-2018-1053",
      },
      {
         cve: "CVE-2018-1058",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-1058",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-1058",
               url: "https://www.suse.com/security/cve/CVE-2018-1058",
            },
            {
               category: "external",
               summary: "SUSE Bug 1081925 for CVE-2018-1058",
               url: "https://bugzilla.suse.com/1081925",
            },
            {
               category: "external",
               summary: "SUSE Bug 1175193 for CVE-2018-1058",
               url: "https://bugzilla.suse.com/1175193",
            },
            {
               category: "external",
               summary: "SUSE Bug 1175194 for CVE-2018-1058",
               url: "https://bugzilla.suse.com/1175194",
            },
            {
               category: "external",
               summary: "SUSE Bug 1185814 for CVE-2018-1058",
               url: "https://bugzilla.suse.com/1185814",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-1058",
      },
      {
         cve: "CVE-2018-10915",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-10915",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with \"host\" or \"hostaddr\" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-10915",
               url: "https://www.suse.com/security/cve/CVE-2018-10915",
            },
            {
               category: "external",
               summary: "SUSE Bug 1104199 for CVE-2018-10915",
               url: "https://bugzilla.suse.com/1104199",
            },
            {
               category: "external",
               summary: "SUSE Bug 1140876 for CVE-2018-10915",
               url: "https://bugzilla.suse.com/1140876",
            },
            {
               category: "external",
               summary: "SUSE Bug 1185814 for CVE-2018-10915",
               url: "https://bugzilla.suse.com/1185814",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2018-10915",
      },
      {
         cve: "CVE-2018-10925",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-10925",
            },
         ],
         notes: [
            {
               category: "general",
               text: "It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-10925",
               url: "https://www.suse.com/security/cve/CVE-2018-10925",
            },
            {
               category: "external",
               summary: "SUSE Bug 1104202 for CVE-2018-10925",
               url: "https://bugzilla.suse.com/1104202",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2018-10925",
      },
      {
         cve: "CVE-2018-1115",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-1115",
            },
         ],
         notes: [
            {
               category: "general",
               text: "postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-1115",
               url: "https://www.suse.com/security/cve/CVE-2018-1115",
            },
            {
               category: "external",
               summary: "SUSE Bug 1091610 for CVE-2018-1115",
               url: "https://bugzilla.suse.com/1091610",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.1,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "critical",
            },
         ],
         title: "CVE-2018-1115",
      },
      {
         cve: "CVE-2018-16850",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-16850",
            },
         ],
         notes: [
            {
               category: "general",
               text: "postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-16850",
               url: "https://www.suse.com/security/cve/CVE-2018-16850",
            },
            {
               category: "external",
               summary: "SUSE Bug 1114837 for CVE-2018-16850",
               url: "https://bugzilla.suse.com/1114837",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "critical",
            },
         ],
         title: "CVE-2018-16850",
      },
      {
         cve: "CVE-2019-10130",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-10130",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-10130",
               url: "https://www.suse.com/security/cve/CVE-2019-10130",
            },
            {
               category: "external",
               summary: "SUSE Bug 1134689 for CVE-2019-10130",
               url: "https://bugzilla.suse.com/1134689",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2019-10130",
      },
      {
         cve: "CVE-2019-10164",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-10164",
            },
         ],
         notes: [
            {
               category: "general",
               text: "PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-10164",
               url: "https://www.suse.com/security/cve/CVE-2019-10164",
            },
            {
               category: "external",
               summary: "SUSE Bug 1138034 for CVE-2019-10164",
               url: "https://bugzilla.suse.com/1138034",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2019-10164",
      },
      {
         cve: "CVE-2019-10208",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-10208",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-10208",
               url: "https://www.suse.com/security/cve/CVE-2019-10208",
            },
            {
               category: "external",
               summary: "SUSE Bug 1145092 for CVE-2019-10208",
               url: "https://bugzilla.suse.com/1145092",
            },
            {
               category: "external",
               summary: "SUSE Bug 1171566 for CVE-2019-10208",
               url: "https://bugzilla.suse.com/1171566",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2019-10208",
      },
      {
         cve: "CVE-2020-14349",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14349",
            },
         ],
         notes: [
            {
               category: "general",
               text: "It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14349",
               url: "https://www.suse.com/security/cve/CVE-2020-14349",
            },
            {
               category: "external",
               summary: "SUSE Bug 1175193 for CVE-2020-14349",
               url: "https://bugzilla.suse.com/1175193",
            },
            {
               category: "external",
               summary: "SUSE Bug 1176151 for CVE-2020-14349",
               url: "https://bugzilla.suse.com/1176151",
            },
            {
               category: "external",
               summary: "SUSE Bug 1179499 for CVE-2020-14349",
               url: "https://bugzilla.suse.com/1179499",
            },
            {
               category: "external",
               summary: "SUSE Bug 1179870 for CVE-2020-14349",
               url: "https://bugzilla.suse.com/1179870",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2020-14349",
      },
      {
         cve: "CVE-2020-14350",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14350",
            },
         ],
         notes: [
            {
               category: "general",
               text: "It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14350",
               url: "https://www.suse.com/security/cve/CVE-2020-14350",
            },
            {
               category: "external",
               summary: "SUSE Bug 1175194 for CVE-2020-14350",
               url: "https://bugzilla.suse.com/1175194",
            },
            {
               category: "external",
               summary: "SUSE Bug 1176151 for CVE-2020-14350",
               url: "https://bugzilla.suse.com/1176151",
            },
            {
               category: "external",
               summary: "SUSE Bug 1179115 for CVE-2020-14350",
               url: "https://bugzilla.suse.com/1179115",
            },
            {
               category: "external",
               summary: "SUSE Bug 1179499 for CVE-2020-14350",
               url: "https://bugzilla.suse.com/1179499",
            },
            {
               category: "external",
               summary: "SUSE Bug 1179870 for CVE-2020-14350",
               url: "https://bugzilla.suse.com/1179870",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.3,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2020-14350",
      },
      {
         cve: "CVE-2020-1720",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-1720",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found in PostgreSQL's \"ALTER ... DEPENDS ON EXTENSION\", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-1720",
               url: "https://www.suse.com/security/cve/CVE-2020-1720",
            },
            {
               category: "external",
               summary: "SUSE Bug 1163985 for CVE-2020-1720",
               url: "https://bugzilla.suse.com/1163985",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.2,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-1720",
      },
      {
         cve: "CVE-2020-25694",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-25694",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-25694",
               url: "https://www.suse.com/security/cve/CVE-2020-25694",
            },
            {
               category: "external",
               summary: "SUSE Bug 1178667 for CVE-2020-25694",
               url: "https://bugzilla.suse.com/1178667",
            },
            {
               category: "external",
               summary: "SUSE Bug 1179870 for CVE-2020-25694",
               url: "https://bugzilla.suse.com/1179870",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-25694",
      },
      {
         cve: "CVE-2020-25695",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-25695",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-25695",
               url: "https://www.suse.com/security/cve/CVE-2020-25695",
            },
            {
               category: "external",
               summary: "SUSE Bug 1178666 for CVE-2020-25695",
               url: "https://bugzilla.suse.com/1178666",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2020-25695",
      },
      {
         cve: "CVE-2020-25696",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-25696",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \\gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-25696",
               url: "https://www.suse.com/security/cve/CVE-2020-25696",
            },
            {
               category: "external",
               summary: "SUSE Bug 1178668 for CVE-2020-25696",
               url: "https://bugzilla.suse.com/1178668",
            },
            {
               category: "external",
               summary: "SUSE Bug 1179870 for CVE-2020-25696",
               url: "https://bugzilla.suse.com/1179870",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2020-25696",
      },
      {
         cve: "CVE-2021-32027",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-32027",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-32027",
               url: "https://www.suse.com/security/cve/CVE-2021-32027",
            },
            {
               category: "external",
               summary: "SUSE Bug 1185924 for CVE-2021-32027",
               url: "https://bugzilla.suse.com/1185924",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-32027",
      },
      {
         cve: "CVE-2021-32028",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-32028",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
               "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-32028",
               url: "https://www.suse.com/security/cve/CVE-2021-32028",
            },
            {
               category: "external",
               summary: "SUSE Bug 1185925 for CVE-2021-32028",
               url: "https://bugzilla.suse.com/1185925",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-contrib-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-devel-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-docs-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plperl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-plpython-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-pltcl-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-server-10.18-1.3.x86_64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.aarch64",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.ppc64le",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.s390x",
                  "openSUSE Tumbleweed:postgresql10-test-10.18-1.3.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-32028",
      },
   ],
}

cve-2018-16850

Vulnerability from cvelistv5

Published

2018-11-13 15:00

Modified

2024-08-05 10:32

Severity ?

8.0 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Summary

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.

References

▼	URL	Tags
	https://usn.ubuntu.com/3818-1/	vendor-advisory, x_refsource_UBUNTU
	https://access.redhat.com/errata/RHSA-2018:3757	vendor-advisory, x_refsource_REDHAT
	https://www.postgresql.org/about/news/1905/	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1042144	vdb-entry, x_refsource_SECTRACK
	https://security.gentoo.org/glsa/201811-24	vendor-advisory, x_refsource_GENTOO
	http://www.securityfocus.com/bid/105923	vdb-entry, x_refsource_BID
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16850	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	The PostgreSQL Project	postgresql	Version: 11.1 Version: 10.6

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T10:32:54.106Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "USN-3818-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3818-1/",
               },
               {
                  name: "RHSA-2018:3757",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3757",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/about/news/1905/",
               },
               {
                  name: "1042144",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1042144",
               },
               {
                  name: "GLSA-201811-24",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201811-24",
               },
               {
                  name: "105923",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105923",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16850",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "The PostgreSQL Project",
               versions: [
                  {
                     status: "affected",
                     version: "11.1",
                  },
                  {
                     status: "affected",
                     version: "10.6",
                  },
               ],
            },
         ],
         datePublic: "2018-11-08T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-89",
                     description: "CWE-89",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-12-03T10:57:01",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "USN-3818-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3818-1/",
            },
            {
               name: "RHSA-2018:3757",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3757",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.postgresql.org/about/news/1905/",
            },
            {
               name: "1042144",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1042144",
            },
            {
               name: "GLSA-201811-24",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201811-24",
            },
            {
               name: "105923",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105923",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16850",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2018-16850",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "postgresql",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "11.1",
                                       },
                                       {
                                          version_value: "10.6",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "The PostgreSQL Project",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "8/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-89",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "USN-3818-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3818-1/",
                  },
                  {
                     name: "RHSA-2018:3757",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3757",
                  },
                  {
                     name: "https://www.postgresql.org/about/news/1905/",
                     refsource: "CONFIRM",
                     url: "https://www.postgresql.org/about/news/1905/",
                  },
                  {
                     name: "1042144",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1042144",
                  },
                  {
                     name: "GLSA-201811-24",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201811-24",
                  },
                  {
                     name: "105923",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105923",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16850",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16850",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2018-16850",
      datePublished: "2018-11-13T15:00:00",
      dateReserved: "2018-09-11T00:00:00",
      dateUpdated: "2024-08-05T10:32:54.106Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-32027

Vulnerability from cvelistv5

Published

2021-06-01 00:00

Modified

2024-08-03 23:17

Severity ?

Summary

A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=1956876
	https://www.postgresql.org/support/security/CVE-2021-32027/
	https://security.netapp.com/advisory/ntap-20210713-0004/
	https://security.gentoo.org/glsa/202211-04	vendor-advisory

Impacted products

	Vendor	Product	Version
	n/a	postgresql	Version: postgresql 13.3, postgresql 12.7, postgresql 11.12, postgresql 10.17, postgresql 9.6.22

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T23:17:27.885Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1956876",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/support/security/CVE-2021-32027/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210713-0004/",
               },
               {
                  name: "GLSA-202211-04",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202211-04",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "postgresql 13.3, postgresql 12.7, postgresql 11.12, postgresql 10.17, postgresql 9.6.22",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-190",
                     description: "CWE-190->CWE-119",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-11-22T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1956876",
            },
            {
               url: "https://www.postgresql.org/support/security/CVE-2021-32027/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20210713-0004/",
            },
            {
               name: "GLSA-202211-04",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202211-04",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2021-32027",
      datePublished: "2021-06-01T00:00:00",
      dateReserved: "2021-05-04T00:00:00",
      dateUpdated: "2024-08-03T23:17:27.885Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-25696

Vulnerability from cvelistv5

Published

2020-11-23 21:15

Modified

2024-08-04 15:40

Severity ?

Summary

A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=1894430	x_refsource_MISC
	https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/202012-07	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	PostgreSQL	Version: All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T15:40:36.672Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1894430",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/",
               },
               {
                  name: "[debian-lts-announce] 20201202 [SECURITY] [DLA 2478-1] postgresql-9.6 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html",
               },
               {
                  name: "GLSA-202012-07",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202012-07",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "PostgreSQL",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \\gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-183",
                     description: "CWE-183->CWE-270",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-12-07T01:06:25",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1894430",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/",
            },
            {
               name: "[debian-lts-announce] 20201202 [SECURITY] [DLA 2478-1] postgresql-9.6 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html",
            },
            {
               name: "GLSA-202012-07",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202012-07",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2020-25696",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "PostgreSQL",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \\gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-183->CWE-270",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1894430",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1894430",
                  },
                  {
                     name: "https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/",
                     refsource: "MISC",
                     url: "https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/",
                  },
                  {
                     name: "[debian-lts-announce] 20201202 [SECURITY] [DLA 2478-1] postgresql-9.6 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html",
                  },
                  {
                     name: "GLSA-202012-07",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202012-07",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-25696",
      datePublished: "2020-11-23T21:15:47",
      dateReserved: "2020-09-16T00:00:00",
      dateUpdated: "2024-08-04T15:40:36.672Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-1052

Vulnerability from cvelistv5

Published

2018-02-09 14:00

Modified

2024-09-16 17:08

Severity ?

Summary

Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of server memory via purpose-crafted insert to a partitioned table.

References

▼	URL	Tags
	https://www.postgresql.org/about/news/1829/	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/102987	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	The PostgreSQL Global Development Group	postgresql	Version: 10.x before 10.2

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T03:44:11.952Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/about/news/1829/",
               },
               {
                  name: "102987",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/102987",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "The PostgreSQL Global Development Group",
               versions: [
                  {
                     status: "affected",
                     version: "10.x before 10.2",
                  },
               ],
            },
         ],
         datePublic: "2018-02-08T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of server memory via purpose-crafted insert to a partitioned table.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-02-14T10:57:01",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.postgresql.org/about/news/1829/",
            },
            {
               name: "102987",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/102987",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               DATE_PUBLIC: "2018-02-08T00:00:00",
               ID: "CVE-2018-1052",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "postgresql",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "10.x before 10.2",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "The PostgreSQL Global Development Group",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of server memory via purpose-crafted insert to a partitioned table.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-200",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.postgresql.org/about/news/1829/",
                     refsource: "CONFIRM",
                     url: "https://www.postgresql.org/about/news/1829/",
                  },
                  {
                     name: "102987",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/102987",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2018-1052",
      datePublished: "2018-02-09T14:00:00Z",
      dateReserved: "2017-12-04T00:00:00",
      dateUpdated: "2024-09-16T17:08:06.088Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-1053

Vulnerability from cvelistv5

Published

2018-02-09 14:00

Modified

2024-09-17 04:20

Severity ?

Summary

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.

References

▼	URL	Tags
	https://www.postgresql.org/about/news/1829/	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:2511	vendor-advisory, x_refsource_REDHAT
	https://lists.debian.org/debian-lts-announce/2018/02/msg00006.html	mailing-list, x_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2018:2566	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:3816	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/102986	vdb-entry, x_refsource_BID
	https://usn.ubuntu.com/3564-1/	vendor-advisory, x_refsource_UBUNTU

Impacted products

	Vendor	Product	Version
	The PostgreSQL Global Development Group	postgresql	Version: 9.3.x before 9.3.21 Version: 9.4.x before 9.4.16 Version: 9.5.x before 9.5.11 Version: 9.6.x before 9.6.7 Version: 10.x before 10.2

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T03:44:11.896Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/about/news/1829/",
               },
               {
                  name: "RHSA-2018:2511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2511",
               },
               {
                  name: "[debian-lts-announce] 20180207 [SECURITY] [DLA-1271-1] postgresql-9.1 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/02/msg00006.html",
               },
               {
                  name: "RHSA-2018:2566",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2566",
               },
               {
                  name: "RHSA-2018:3816",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3816",
               },
               {
                  name: "102986",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/102986",
               },
               {
                  name: "USN-3564-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3564-1/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "The PostgreSQL Global Development Group",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.x before 9.3.21",
                  },
                  {
                     status: "affected",
                     version: "9.4.x before 9.4.16",
                  },
                  {
                     status: "affected",
                     version: "9.5.x before 9.5.11",
                  },
                  {
                     status: "affected",
                     version: "9.6.x before 9.6.7",
                  },
                  {
                     status: "affected",
                     version: "10.x before 10.2",
                  },
               ],
            },
         ],
         datePublic: "2018-02-08T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-377",
                     description: "CWE-377",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-12-14T10:57:02",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.postgresql.org/about/news/1829/",
            },
            {
               name: "RHSA-2018:2511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2511",
            },
            {
               name: "[debian-lts-announce] 20180207 [SECURITY] [DLA-1271-1] postgresql-9.1 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/02/msg00006.html",
            },
            {
               name: "RHSA-2018:2566",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2566",
            },
            {
               name: "RHSA-2018:3816",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3816",
            },
            {
               name: "102986",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/102986",
            },
            {
               name: "USN-3564-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3564-1/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               DATE_PUBLIC: "2018-02-08T00:00:00",
               ID: "CVE-2018-1053",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "postgresql",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "9.3.x before 9.3.21",
                                       },
                                       {
                                          version_value: "9.4.x before 9.4.16",
                                       },
                                       {
                                          version_value: "9.5.x before 9.5.11",
                                       },
                                       {
                                          version_value: "9.6.x before 9.6.7",
                                       },
                                       {
                                          version_value: "10.x before 10.2",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "The PostgreSQL Global Development Group",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-377",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.postgresql.org/about/news/1829/",
                     refsource: "CONFIRM",
                     url: "https://www.postgresql.org/about/news/1829/",
                  },
                  {
                     name: "RHSA-2018:2511",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2511",
                  },
                  {
                     name: "[debian-lts-announce] 20180207 [SECURITY] [DLA-1271-1] postgresql-9.1 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/02/msg00006.html",
                  },
                  {
                     name: "RHSA-2018:2566",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2566",
                  },
                  {
                     name: "RHSA-2018:3816",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3816",
                  },
                  {
                     name: "102986",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/102986",
                  },
                  {
                     name: "USN-3564-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3564-1/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2018-1053",
      datePublished: "2018-02-09T14:00:00Z",
      dateReserved: "2017-12-04T00:00:00",
      dateUpdated: "2024-09-17T04:20:15.991Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-10130

Vulnerability from cvelistv5

Published

2019-07-30 16:13

Modified

2024-08-04 22:10

Severity ?

3.1 (Low) - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.

References

▼	URL	Tags
	https://www.postgresql.org/about/news/1939/	x_refsource_MISC
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10130	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202003-03	vendor-advisory, x_refsource_GENTOO
	http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	PostgreSQL Project	postgresql	Version: 11.x up to, excluding 11.3 Version: 10.x up to, excluding 10.8 Version: 9.6.x up to, excluding 9.6.13 Version: 9.5.x up to, excluding 9.5.17

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T22:10:09.927Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/about/news/1939/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10130",
               },
               {
                  name: "GLSA-202003-03",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-03",
               },
               {
                  name: "openSUSE-SU-2020:1227",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "PostgreSQL Project",
               versions: [
                  {
                     status: "affected",
                     version: "11.x up to, excluding 11.3",
                  },
                  {
                     status: "affected",
                     version: "10.x up to, excluding 10.8",
                  },
                  {
                     status: "affected",
                     version: "9.6.x up to, excluding 9.6.13",
                  },
                  {
                     status: "affected",
                     version: "9.5.x up to, excluding 9.5.17",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 3.1,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-284",
                     description: "CWE-284",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-08-17T17:06:14",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.postgresql.org/about/news/1939/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10130",
            },
            {
               name: "GLSA-202003-03",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202003-03",
            },
            {
               name: "openSUSE-SU-2020:1227",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2019-10130",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "postgresql",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "11.x up to, excluding 11.3",
                                       },
                                       {
                                          version_value: "10.x up to, excluding 10.8",
                                       },
                                       {
                                          version_value: "9.6.x up to, excluding 9.6.13",
                                       },
                                       {
                                          version_value: "9.5.x up to, excluding 9.5.17",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "PostgreSQL Project",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "3.1/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-284",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.postgresql.org/about/news/1939/",
                     refsource: "MISC",
                     url: "https://www.postgresql.org/about/news/1939/",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10130",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10130",
                  },
                  {
                     name: "GLSA-202003-03",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202003-03",
                  },
                  {
                     name: "openSUSE-SU-2020:1227",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2019-10130",
      datePublished: "2019-07-30T16:13:46",
      dateReserved: "2019-03-27T00:00:00",
      dateUpdated: "2024-08-04T22:10:09.927Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-1058

Vulnerability from cvelistv5

Published

2018-03-02 15:00

Modified

2024-09-17 03:22

Severity ?

Summary

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=1547044	x_refsource_CONFIRM
	https://usn.ubuntu.com/3589-1/	vendor-advisory, x_refsource_UBUNTU
	http://www.securityfocus.com/bid/103221	vdb-entry, x_refsource_BID
	https://www.postgresql.org/about/news/1834/	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:2511	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:2566	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:3816	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	The PostgreSQL Global Development Group	postgresql	Version: 9.3 - 10

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T03:44:11.804Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1547044",
               },
               {
                  name: "USN-3589-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3589-1/",
               },
               {
                  name: "103221",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/103221",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/about/news/1834/",
               },
               {
                  name: "RHSA-2018:2511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2511",
               },
               {
                  name: "RHSA-2018:2566",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2566",
               },
               {
                  name: "RHSA-2018:3816",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3816",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "The PostgreSQL Global Development Group",
               versions: [
                  {
                     status: "affected",
                     version: "9.3 - 10",
                  },
               ],
            },
         ],
         datePublic: "2018-03-01T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-20",
                     description: "CWE-20",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-12-14T10:57:02",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1547044",
            },
            {
               name: "USN-3589-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3589-1/",
            },
            {
               name: "103221",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/103221",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.postgresql.org/about/news/1834/",
            },
            {
               name: "RHSA-2018:2511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2511",
            },
            {
               name: "RHSA-2018:2566",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2566",
            },
            {
               name: "RHSA-2018:3816",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3816",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               DATE_PUBLIC: "2018-03-01T00:00:00",
               ID: "CVE-2018-1058",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "postgresql",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "9.3 - 10",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "The PostgreSQL Global Development Group",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-20",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1547044",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1547044",
                  },
                  {
                     name: "USN-3589-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3589-1/",
                  },
                  {
                     name: "103221",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/103221",
                  },
                  {
                     name: "https://www.postgresql.org/about/news/1834/",
                     refsource: "CONFIRM",
                     url: "https://www.postgresql.org/about/news/1834/",
                  },
                  {
                     name: "RHSA-2018:2511",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2511",
                  },
                  {
                     name: "RHSA-2018:2566",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2566",
                  },
                  {
                     name: "RHSA-2018:3816",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3816",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2018-1058",
      datePublished: "2018-03-02T15:00:00Z",
      dateReserved: "2017-12-04T00:00:00",
      dateUpdated: "2024-09-17T03:22:50.533Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-10915

Vulnerability from cvelistv5

Published

2018-08-09 20:00

Modified

2024-08-05 07:54

Severity ?

8.5 (High) - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected.

References

▼	URL	Tags
	https://security.gentoo.org/glsa/201810-08	vendor-advisory, x_refsource_GENTOO
	https://access.redhat.com/errata/RHSA-2018:2729	vendor-advisory, x_refsource_REDHAT
	https://www.debian.org/security/2018/dsa-4269	vendor-advisory, x_refsource_DEBIAN
	https://access.redhat.com/errata/RHSA-2018:2643	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:2721	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:2511	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/3744-1/	vendor-advisory, x_refsource_UBUNTU
	https://lists.debian.org/debian-lts-announce/2018/08/msg00012.html	mailing-list, x_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2018:2566	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:2565	vendor-advisory, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:3816	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/105054	vdb-entry, x_refsource_BID
	https://www.postgresql.org/about/news/1878/	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:2557	vendor-advisory, x_refsource_REDHAT
	http://www.securitytracker.com/id/1041446	vdb-entry, x_refsource_SECTRACK
	http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	PostgreSQL Global Development Group	postgresql	Version: 10.5 Version: 9.6.10 Version: 9.5.14 Version: 9.4.19 Version: 9.3.24

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T07:54:36.359Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "GLSA-201810-08",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201810-08",
               },
               {
                  name: "RHSA-2018:2729",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2729",
               },
               {
                  name: "DSA-4269",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4269",
               },
               {
                  name: "RHSA-2018:2643",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2643",
               },
               {
                  name: "RHSA-2018:2721",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2721",
               },
               {
                  name: "RHSA-2018:2511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2511",
               },
               {
                  name: "USN-3744-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3744-1/",
               },
               {
                  name: "[debian-lts-announce] 20180815 [SECURITY] [DLA 1464-1] postgresql-9.4 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/08/msg00012.html",
               },
               {
                  name: "RHSA-2018:2566",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2566",
               },
               {
                  name: "RHSA-2018:2565",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2565",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915",
               },
               {
                  name: "RHSA-2018:3816",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3816",
               },
               {
                  name: "105054",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105054",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/about/news/1878/",
               },
               {
                  name: "RHSA-2018:2557",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2557",
               },
               {
                  name: "1041446",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1041446",
               },
               {
                  name: "openSUSE-SU-2020:1227",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "PostgreSQL Global Development Group",
               versions: [
                  {
                     status: "affected",
                     version: "10.5",
                  },
                  {
                     status: "affected",
                     version: "9.6.10",
                  },
                  {
                     status: "affected",
                     version: "9.5.14",
                  },
                  {
                     status: "affected",
                     version: "9.4.19",
                  },
                  {
                     status: "affected",
                     version: "9.3.24",
                  },
               ],
            },
         ],
         datePublic: "2018-08-09T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with \"host\" or \"hostaddr\" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-665",
                     description: "CWE-665",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-89",
                     description: "CWE-89",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-08-17T17:06:12",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "GLSA-201810-08",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201810-08",
            },
            {
               name: "RHSA-2018:2729",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2729",
            },
            {
               name: "DSA-4269",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4269",
            },
            {
               name: "RHSA-2018:2643",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2643",
            },
            {
               name: "RHSA-2018:2721",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2721",
            },
            {
               name: "RHSA-2018:2511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2511",
            },
            {
               name: "USN-3744-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3744-1/",
            },
            {
               name: "[debian-lts-announce] 20180815 [SECURITY] [DLA 1464-1] postgresql-9.4 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/08/msg00012.html",
            },
            {
               name: "RHSA-2018:2566",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2566",
            },
            {
               name: "RHSA-2018:2565",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2565",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915",
            },
            {
               name: "RHSA-2018:3816",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3816",
            },
            {
               name: "105054",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105054",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.postgresql.org/about/news/1878/",
            },
            {
               name: "RHSA-2018:2557",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2557",
            },
            {
               name: "1041446",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1041446",
            },
            {
               name: "openSUSE-SU-2020:1227",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2018-10915",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "postgresql",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "10.5",
                                       },
                                       {
                                          version_value: "9.6.10",
                                       },
                                       {
                                          version_value: "9.5.14",
                                       },
                                       {
                                          version_value: "9.4.19",
                                       },
                                       {
                                          version_value: "9.3.24",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "PostgreSQL Global Development Group",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with \"host\" or \"hostaddr\" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "8.5/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-665",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-200",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-89",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "GLSA-201810-08",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201810-08",
                  },
                  {
                     name: "RHSA-2018:2729",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2729",
                  },
                  {
                     name: "DSA-4269",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4269",
                  },
                  {
                     name: "RHSA-2018:2643",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2643",
                  },
                  {
                     name: "RHSA-2018:2721",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2721",
                  },
                  {
                     name: "RHSA-2018:2511",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2511",
                  },
                  {
                     name: "USN-3744-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3744-1/",
                  },
                  {
                     name: "[debian-lts-announce] 20180815 [SECURITY] [DLA 1464-1] postgresql-9.4 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/08/msg00012.html",
                  },
                  {
                     name: "RHSA-2018:2566",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2566",
                  },
                  {
                     name: "RHSA-2018:2565",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2565",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10915",
                  },
                  {
                     name: "RHSA-2018:3816",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3816",
                  },
                  {
                     name: "105054",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105054",
                  },
                  {
                     name: "https://www.postgresql.org/about/news/1878/",
                     refsource: "CONFIRM",
                     url: "https://www.postgresql.org/about/news/1878/",
                  },
                  {
                     name: "RHSA-2018:2557",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2557",
                  },
                  {
                     name: "1041446",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1041446",
                  },
                  {
                     name: "openSUSE-SU-2020:1227",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2018-10915",
      datePublished: "2018-08-09T20:00:00",
      dateReserved: "2018-05-09T00:00:00",
      dateUpdated: "2024-08-05T07:54:36.359Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-1115

Vulnerability from cvelistv5

Published

2018-05-10 19:00

Modified

2024-08-05 03:51

Severity ?

4.2 (Medium) - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Summary

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.

References

▼	URL	Tags
	https://security.gentoo.org/glsa/201810-08	vendor-advisory, x_refsource_GENTOO
	https://access.redhat.com/errata/RHSA-2018:2566	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:2565	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/104285	vdb-entry, x_refsource_BID
	http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html	vendor-advisory, x_refsource_SUSE
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1115	x_refsource_CONFIRM
	https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=7b34740	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	unspecified	postgresql	Version: postegresql 10.4 Version: postegresql 9.6.9

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T03:51:48.772Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "GLSA-201810-08",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201810-08",
               },
               {
                  name: "RHSA-2018:2566",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2566",
               },
               {
                  name: "RHSA-2018:2565",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2565",
               },
               {
                  name: "104285",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/104285",
               },
               {
                  name: "openSUSE-SU-2020:1227",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1115",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=7b34740",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "unspecified",
               versions: [
                  {
                     status: "affected",
                     version: "postegresql 10.4",
                  },
                  {
                     status: "affected",
                     version: " postegresql 9.6.9",
                  },
               ],
            },
         ],
         datePublic: "2018-04-30T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 4.2,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-732",
                     description: "CWE-732",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-12-04T18:00:58",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "GLSA-201810-08",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201810-08",
            },
            {
               name: "RHSA-2018:2566",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2566",
            },
            {
               name: "RHSA-2018:2565",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2565",
            },
            {
               name: "104285",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/104285",
            },
            {
               name: "openSUSE-SU-2020:1227",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1115",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=7b34740",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2018-1115",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "postgresql",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "postegresql 10.4",
                                       },
                                       {
                                          version_value: " postegresql 9.6.9",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "4.2/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-732",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "GLSA-201810-08",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201810-08",
                  },
                  {
                     name: "RHSA-2018:2566",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2566",
                  },
                  {
                     name: "RHSA-2018:2565",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2565",
                  },
                  {
                     name: "104285",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/104285",
                  },
                  {
                     name: "openSUSE-SU-2020:1227",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1115",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1115",
                  },
                  {
                     name: "https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=7b34740",
                     refsource: "CONFIRM",
                     url: "https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=7b34740",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2018-1115",
      datePublished: "2018-05-10T19:00:00",
      dateReserved: "2017-12-04T00:00:00",
      dateUpdated: "2024-08-05T03:51:48.772Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2017-15098

Vulnerability from cvelistv5

Published

2017-11-22 17:00

Modified

2024-09-16 23:10

Severity ?

Summary

Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/101781	vdb-entry, x_refsource_BID
	https://www.debian.org/security/2017/dsa-4027	vendor-advisory, x_refsource_DEBIAN
	https://access.redhat.com/errata/RHSA-2018:2511	vendor-advisory, x_refsource_REDHAT
	https://www.postgresql.org/support/security/	x_refsource_MISC
	http://www.securitytracker.com/id/1039752	vdb-entry, x_refsource_SECTRACK
	https://www.postgresql.org/about/news/1801/	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:2566	vendor-advisory, x_refsource_REDHAT
	https://www.debian.org/security/2017/dsa-4028	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	Red Hat, Inc.	postgresql	Version: 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T19:50:14.965Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "101781",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/101781",
               },
               {
                  name: "DSA-4027",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2017/dsa-4027",
               },
               {
                  name: "RHSA-2018:2511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2511",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/support/security/",
               },
               {
                  name: "1039752",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1039752",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/about/news/1801/",
               },
               {
                  name: "RHSA-2018:2566",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2566",
               },
               {
                  name: "DSA-4028",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2017/dsa-4028",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "Red Hat, Inc.",
               versions: [
                  {
                     status: "affected",
                     version: "10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20",
                  },
               ],
            },
         ],
         datePublic: "2017-11-09T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-08-28T09:57:01",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "101781",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/101781",
            },
            {
               name: "DSA-4027",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2017/dsa-4027",
            },
            {
               name: "RHSA-2018:2511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2511",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.postgresql.org/support/security/",
            },
            {
               name: "1039752",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1039752",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.postgresql.org/about/news/1801/",
            },
            {
               name: "RHSA-2018:2566",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2566",
            },
            {
               name: "DSA-4028",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2017/dsa-4028",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               DATE_PUBLIC: "2017-11-09T00:00:00",
               ID: "CVE-2017-15098",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "postgresql",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Red Hat, Inc.",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-200",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "101781",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/101781",
                  },
                  {
                     name: "DSA-4027",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2017/dsa-4027",
                  },
                  {
                     name: "RHSA-2018:2511",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2511",
                  },
                  {
                     name: "https://www.postgresql.org/support/security/",
                     refsource: "MISC",
                     url: "https://www.postgresql.org/support/security/",
                  },
                  {
                     name: "1039752",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1039752",
                  },
                  {
                     name: "https://www.postgresql.org/about/news/1801/",
                     refsource: "CONFIRM",
                     url: "https://www.postgresql.org/about/news/1801/",
                  },
                  {
                     name: "RHSA-2018:2566",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2566",
                  },
                  {
                     name: "DSA-4028",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2017/dsa-4028",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2017-15098",
      datePublished: "2017-11-22T17:00:00Z",
      dateReserved: "2017-10-08T00:00:00",
      dateUpdated: "2024-09-16T23:10:51.250Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-25695

Vulnerability from cvelistv5

Published

2020-11-16 00:40

Modified

2024-08-04 15:40

Severity ?

Summary

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

References

▼	URL	Tags
	https://www.postgresql.org/support/security/	x_refsource_MISC
	https://bugzilla.redhat.com/show_bug.cgi?id=1894425	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20201202-0003/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/202012-07	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	postgresql	Version: All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T15:40:36.702Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/support/security/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1894425",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20201202-0003/",
               },
               {
                  name: "[debian-lts-announce] 20201202 [SECURITY] [DLA 2478-1] postgresql-9.6 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html",
               },
               {
                  name: "GLSA-202012-07",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202012-07",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-89",
                     description: "CWE-89",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-12-07T01:06:27",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.postgresql.org/support/security/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1894425",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20201202-0003/",
            },
            {
               name: "[debian-lts-announce] 20201202 [SECURITY] [DLA 2478-1] postgresql-9.6 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html",
            },
            {
               name: "GLSA-202012-07",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202012-07",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2020-25695",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "postgresql",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-89",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.postgresql.org/support/security/",
                     refsource: "MISC",
                     url: "https://www.postgresql.org/support/security/",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1894425",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1894425",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20201202-0003/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20201202-0003/",
                  },
                  {
                     name: "[debian-lts-announce] 20201202 [SECURITY] [DLA 2478-1] postgresql-9.6 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html",
                  },
                  {
                     name: "GLSA-202012-07",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202012-07",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-25695",
      datePublished: "2020-11-16T00:40:36",
      dateReserved: "2020-09-16T00:00:00",
      dateUpdated: "2024-08-04T15:40:36.702Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-25694

Vulnerability from cvelistv5

Published

2020-11-16 00:38

Modified

2024-08-04 15:40

Severity ?

Summary

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=1894423	x_refsource_MISC
	https://www.postgresql.org/support/security/	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20201202-0003/	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202012-07	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	postgresql	Version: All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T15:40:36.685Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1894423",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/support/security/",
               },
               {
                  name: "[debian-lts-announce] 20201202 [SECURITY] [DLA 2478-1] postgresql-9.6 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20201202-0003/",
               },
               {
                  name: "GLSA-202012-07",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202012-07",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-327",
                     description: "CWE-327",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-12-07T01:06:26",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1894423",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.postgresql.org/support/security/",
            },
            {
               name: "[debian-lts-announce] 20201202 [SECURITY] [DLA 2478-1] postgresql-9.6 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20201202-0003/",
            },
            {
               name: "GLSA-202012-07",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202012-07",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2020-25694",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "postgresql",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-327",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1894423",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1894423",
                  },
                  {
                     name: "https://www.postgresql.org/support/security/",
                     refsource: "MISC",
                     url: "https://www.postgresql.org/support/security/",
                  },
                  {
                     name: "[debian-lts-announce] 20201202 [SECURITY] [DLA 2478-1] postgresql-9.6 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20201202-0003/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20201202-0003/",
                  },
                  {
                     name: "GLSA-202012-07",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202012-07",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-25694",
      datePublished: "2020-11-16T00:38:53",
      dateReserved: "2020-09-16T00:00:00",
      dateUpdated: "2024-08-04T15:40:36.685Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-10164

Vulnerability from cvelistv5

Published

2019-06-26 15:29

Modified

2024-08-04 22:10

Severity ?

7.5 (High) - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10164	x_refsource_CONFIRM
	https://www.postgresql.org/about/news/1949/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00035.html	vendor-advisory, x_refsource_SUSE
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAGE6H4FWLKFLHLWVYNPYGQRPIXTUWGB/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTKEHXGDXYYD6WYDIIQJP4GDQJSENDJK/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202003-03	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	PostgreSQL	PostgreSQL	Version: 10.9 Version: 11.4

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T22:10:10.043Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10164",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/about/news/1949/",
               },
               {
                  name: "openSUSE-SU-2019:1773",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00035.html",
               },
               {
                  name: "FEDORA-2019-9f04a701c0",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAGE6H4FWLKFLHLWVYNPYGQRPIXTUWGB/",
               },
               {
                  name: "FEDORA-2019-e43f49b428",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTKEHXGDXYYD6WYDIIQJP4GDQJSENDJK/",
               },
               {
                  name: "GLSA-202003-03",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-03",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "PostgreSQL",
               vendor: "PostgreSQL",
               versions: [
                  {
                     status: "affected",
                     version: "10.9",
                  },
                  {
                     status: "affected",
                     version: "11.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-121",
                     description: "CWE-121",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-03-12T21:06:08",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10164",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.postgresql.org/about/news/1949/",
            },
            {
               name: "openSUSE-SU-2019:1773",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00035.html",
            },
            {
               name: "FEDORA-2019-9f04a701c0",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAGE6H4FWLKFLHLWVYNPYGQRPIXTUWGB/",
            },
            {
               name: "FEDORA-2019-e43f49b428",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTKEHXGDXYYD6WYDIIQJP4GDQJSENDJK/",
            },
            {
               name: "GLSA-202003-03",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202003-03",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2019-10164",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "PostgreSQL",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "10.9",
                                       },
                                       {
                                          version_value: "11.4",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "PostgreSQL",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "7.5/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-121",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10164",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10164",
                  },
                  {
                     name: "https://www.postgresql.org/about/news/1949/",
                     refsource: "MISC",
                     url: "https://www.postgresql.org/about/news/1949/",
                  },
                  {
                     name: "openSUSE-SU-2019:1773",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00035.html",
                  },
                  {
                     name: "FEDORA-2019-9f04a701c0",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAGE6H4FWLKFLHLWVYNPYGQRPIXTUWGB/",
                  },
                  {
                     name: "FEDORA-2019-e43f49b428",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TTKEHXGDXYYD6WYDIIQJP4GDQJSENDJK/",
                  },
                  {
                     name: "GLSA-202003-03",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202003-03",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2019-10164",
      datePublished: "2019-06-26T15:29:13",
      dateReserved: "2019-03-27T00:00:00",
      dateUpdated: "2024-08-04T22:10:10.043Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-32028

Vulnerability from cvelistv5

Published

2021-10-11 00:00

Modified

2024-08-03 23:17

Severity ?

Summary

A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=1956877
	https://www.postgresql.org/support/security/CVE-2021-32028
	https://security.netapp.com/advisory/ntap-20211112-0003/
	https://security.gentoo.org/glsa/202211-04	vendor-advisory

Impacted products

	Vendor	Product	Version
	n/a	postgresql	Version: postgresql 13.3, postgresql 12.7, postgresql 11.12, postgresql 10.17, postgresql 9.6.22

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T23:17:28.199Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1956877",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/support/security/CVE-2021-32028",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211112-0003/",
               },
               {
                  name: "GLSA-202211-04",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202211-04",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "postgresql 13.3, postgresql 12.7, postgresql 11.12, postgresql 10.17, postgresql 9.6.22",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-11-22T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1956877",
            },
            {
               url: "https://www.postgresql.org/support/security/CVE-2021-32028",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211112-0003/",
            },
            {
               name: "GLSA-202211-04",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202211-04",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2021-32028",
      datePublished: "2021-10-11T00:00:00",
      dateReserved: "2021-05-04T00:00:00",
      dateUpdated: "2024-08-03T23:17:28.199Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2017-15099

Vulnerability from cvelistv5

Published

2017-11-22 18:00

Modified

2024-09-16 16:43

Severity ?

Summary

INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/101781	vdb-entry, x_refsource_BID
	https://access.redhat.com/errata/RHSA-2018:2511	vendor-advisory, x_refsource_REDHAT
	https://www.postgresql.org/support/security/	x_refsource_MISC
	http://www.securitytracker.com/id/1039752	vdb-entry, x_refsource_SECTRACK
	https://www.postgresql.org/about/news/1801/	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:2566	vendor-advisory, x_refsource_REDHAT
	https://www.debian.org/security/2017/dsa-4028	vendor-advisory, x_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	Red Hat, Inc.	postgresql	Version: 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T19:50:16.128Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "101781",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/101781",
               },
               {
                  name: "RHSA-2018:2511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2511",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/support/security/",
               },
               {
                  name: "1039752",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1039752",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/about/news/1801/",
               },
               {
                  name: "RHSA-2018:2566",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2566",
               },
               {
                  name: "DSA-4028",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2017/dsa-4028",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "Red Hat, Inc.",
               versions: [
                  {
                     status: "affected",
                     version: "10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10",
                  },
               ],
            },
         ],
         datePublic: "2017-11-09T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-08-28T09:57:01",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "101781",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/101781",
            },
            {
               name: "RHSA-2018:2511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2511",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.postgresql.org/support/security/",
            },
            {
               name: "1039752",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1039752",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.postgresql.org/about/news/1801/",
            },
            {
               name: "RHSA-2018:2566",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2566",
            },
            {
               name: "DSA-4028",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2017/dsa-4028",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               DATE_PUBLIC: "2017-11-09T00:00:00",
               ID: "CVE-2017-15099",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "postgresql",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Red Hat, Inc.",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-200",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "101781",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/101781",
                  },
                  {
                     name: "RHSA-2018:2511",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2511",
                  },
                  {
                     name: "https://www.postgresql.org/support/security/",
                     refsource: "MISC",
                     url: "https://www.postgresql.org/support/security/",
                  },
                  {
                     name: "1039752",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1039752",
                  },
                  {
                     name: "https://www.postgresql.org/about/news/1801/",
                     refsource: "CONFIRM",
                     url: "https://www.postgresql.org/about/news/1801/",
                  },
                  {
                     name: "RHSA-2018:2566",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2566",
                  },
                  {
                     name: "DSA-4028",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2017/dsa-4028",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2017-15099",
      datePublished: "2017-11-22T18:00:00Z",
      dateReserved: "2017-10-08T00:00:00",
      dateUpdated: "2024-09-16T16:43:27.924Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-1720

Vulnerability from cvelistv5

Published

2020-03-17 15:28

Modified

2024-08-04 06:46

Severity ?

3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Summary

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1720	x_refsource_CONFIRM
	https://www.postgresql.org/about/news/2011/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	Red Hat	postgresql	Version: 12.2 Version: 11.7 Version: 10.12 Version: 9.6.17

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T06:46:30.847Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1720",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/about/news/2011/",
               },
               {
                  name: "openSUSE-SU-2020:1227",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "Red Hat",
               versions: [
                  {
                     status: "affected",
                     version: "12.2",
                  },
                  {
                     status: "affected",
                     version: "11.7",
                  },
                  {
                     status: "affected",
                     version: "10.12",
                  },
                  {
                     status: "affected",
                     version: "9.6.17",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in PostgreSQL's \"ALTER ... DEPENDS ON EXTENSION\", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 3.1,
                  baseSeverity: "LOW",
                  confidentialityImpact: "NONE",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-285",
                     description: "CWE-285",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-08-17T17:06:13",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1720",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.postgresql.org/about/news/2011/",
            },
            {
               name: "openSUSE-SU-2020:1227",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2020-1720",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "postgresql",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "12.2",
                                       },
                                       {
                                          version_value: "11.7",
                                       },
                                       {
                                          version_value: "10.12",
                                       },
                                       {
                                          version_value: "9.6.17",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Red Hat",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in PostgreSQL's \"ALTER ... DEPENDS ON EXTENSION\", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "3.1/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-285",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1720",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1720",
                  },
                  {
                     name: "https://www.postgresql.org/about/news/2011/",
                     refsource: "MISC",
                     url: "https://www.postgresql.org/about/news/2011/",
                  },
                  {
                     name: "openSUSE-SU-2020:1227",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-1720",
      datePublished: "2020-03-17T15:28:24",
      dateReserved: "2019-11-27T00:00:00",
      dateUpdated: "2024-08-04T06:46:30.847Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-10925

Vulnerability from cvelistv5

Published

2018-08-09 21:00

Modified

2024-08-05 07:54

Severity ?

7.1 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Summary

It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could exploit this to update other columns in the same table.

References

▼	URL	Tags
	https://security.gentoo.org/glsa/201810-08	vendor-advisory, x_refsource_GENTOO
	https://www.debian.org/security/2018/dsa-4269	vendor-advisory, x_refsource_DEBIAN
	http://www.securityfocus.com/bid/105052	vdb-entry, x_refsource_BID
	https://access.redhat.com/errata/RHSA-2018:2511	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/3744-1/	vendor-advisory, x_refsource_UBUNTU
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:2566	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:2565	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:3816	vendor-advisory, x_refsource_REDHAT
	https://www.postgresql.org/about/news/1878/	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1041446	vdb-entry, x_refsource_SECTRACK
	http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	PostgreSQL Global Development Group	postgresql	Version: 10.5 Version: 9.6.10 Version: 9.5.14 Version: 9.4.19 Version: 9.3.24

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T07:54:36.061Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "GLSA-201810-08",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201810-08",
               },
               {
                  name: "DSA-4269",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4269",
               },
               {
                  name: "105052",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105052",
               },
               {
                  name: "RHSA-2018:2511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2511",
               },
               {
                  name: "USN-3744-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3744-1/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925",
               },
               {
                  name: "RHSA-2018:2566",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2566",
               },
               {
                  name: "RHSA-2018:2565",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2565",
               },
               {
                  name: "RHSA-2018:3816",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3816",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/about/news/1878/",
               },
               {
                  name: "1041446",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1041446",
               },
               {
                  name: "openSUSE-SU-2020:1227",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "PostgreSQL Global Development Group",
               versions: [
                  {
                     status: "affected",
                     version: "10.5",
                  },
                  {
                     status: "affected",
                     version: "9.6.10",
                  },
                  {
                     status: "affected",
                     version: "9.5.14",
                  },
                  {
                     status: "affected",
                     version: "9.4.19",
                  },
                  {
                     status: "affected",
                     version: "9.3.24",
                  },
               ],
            },
         ],
         datePublic: "2018-08-09T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-863",
                     description: "CWE-863",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-08-17T17:06:15",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "GLSA-201810-08",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201810-08",
            },
            {
               name: "DSA-4269",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4269",
            },
            {
               name: "105052",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105052",
            },
            {
               name: "RHSA-2018:2511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2511",
            },
            {
               name: "USN-3744-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3744-1/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925",
            },
            {
               name: "RHSA-2018:2566",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2566",
            },
            {
               name: "RHSA-2018:2565",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2565",
            },
            {
               name: "RHSA-2018:3816",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3816",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.postgresql.org/about/news/1878/",
            },
            {
               name: "1041446",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1041446",
            },
            {
               name: "openSUSE-SU-2020:1227",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2018-10925",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "postgresql",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "10.5",
                                       },
                                       {
                                          version_value: "9.6.10",
                                       },
                                       {
                                          version_value: "9.5.14",
                                       },
                                       {
                                          version_value: "9.4.19",
                                       },
                                       {
                                          version_value: "9.3.24",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "PostgreSQL Global Development Group",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with \"INSERT ... ON CONFLICT DO UPDATE\". An attacker with \"CREATE TABLE\" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain \"INSERT\" and limited \"UPDATE\" privileges to a particular table, they could exploit this to update other columns in the same table.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "7.1/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-863",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "GLSA-201810-08",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201810-08",
                  },
                  {
                     name: "DSA-4269",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4269",
                  },
                  {
                     name: "105052",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105052",
                  },
                  {
                     name: "RHSA-2018:2511",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2511",
                  },
                  {
                     name: "USN-3744-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3744-1/",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10925",
                  },
                  {
                     name: "RHSA-2018:2566",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2566",
                  },
                  {
                     name: "RHSA-2018:2565",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2565",
                  },
                  {
                     name: "RHSA-2018:3816",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3816",
                  },
                  {
                     name: "https://www.postgresql.org/about/news/1878/",
                     refsource: "CONFIRM",
                     url: "https://www.postgresql.org/about/news/1878/",
                  },
                  {
                     name: "1041446",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1041446",
                  },
                  {
                     name: "openSUSE-SU-2020:1227",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2018-10925",
      datePublished: "2018-08-09T21:00:00",
      dateReserved: "2018-05-09T00:00:00",
      dateUpdated: "2024-08-05T07:54:36.061Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14350

Vulnerability from cvelistv5

Published

2020-08-24 12:42

Modified

2024-08-04 12:39

Severity ?

Summary

It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.

References

▼	URL	Tags
	http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html	vendor-advisory, x_refsource_SUSE
	https://bugzilla.redhat.com/show_bug.cgi?id=1865746	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2020/08/msg00028.html	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/202008-13	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4472-1/	vendor-advisory, x_refsource_UBUNTU
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html	vendor-advisory, x_refsource_SUSE
	https://security.netapp.com/advisory/ntap-20200918-0002/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	PostgreSQL	Version: PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:39:36.524Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "openSUSE-SU-2020:1227",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
               },
               {
                  name: "openSUSE-SU-2020:1228",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html",
               },
               {
                  name: "openSUSE-SU-2020:1244",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html",
               },
               {
                  name: "openSUSE-SU-2020:1243",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1865746",
               },
               {
                  name: "[debian-lts-announce] 20200817 [SECURITY] [DLA 2331-1] posgresql-9.6 security update",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/08/msg00028.html",
               },
               {
                  name: "GLSA-202008-13",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202008-13",
               },
               {
                  name: "USN-4472-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/4472-1/",
               },
               {
                  name: "openSUSE-SU-2020:1312",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html",
               },
               {
                  name: "openSUSE-SU-2020:1326",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20200918-0002/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "PostgreSQL",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Improper Input Validation",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-09-18T11:06:17",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "openSUSE-SU-2020:1227",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
            },
            {
               name: "openSUSE-SU-2020:1228",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html",
            },
            {
               name: "openSUSE-SU-2020:1244",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html",
            },
            {
               name: "openSUSE-SU-2020:1243",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1865746",
            },
            {
               name: "[debian-lts-announce] 20200817 [SECURITY] [DLA 2331-1] posgresql-9.6 security update",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/08/msg00028.html",
            },
            {
               name: "GLSA-202008-13",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202008-13",
            },
            {
               name: "USN-4472-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/4472-1/",
            },
            {
               name: "openSUSE-SU-2020:1312",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html",
            },
            {
               name: "openSUSE-SU-2020:1326",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20200918-0002/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2020-14350",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "PostgreSQL",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Improper Input Validation",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "openSUSE-SU-2020:1227",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1228",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1244",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1243",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1865746",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1865746",
                  },
                  {
                     name: "[debian-lts-announce] 20200817 [SECURITY] [DLA 2331-1] posgresql-9.6 security update",
                     refsource: "DEBIAN",
                     url: "https://lists.debian.org/debian-lts-announce/2020/08/msg00028.html",
                  },
                  {
                     name: "GLSA-202008-13",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202008-13",
                  },
                  {
                     name: "USN-4472-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/4472-1/",
                  },
                  {
                     name: "openSUSE-SU-2020:1312",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1326",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20200918-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20200918-0002/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-14350",
      datePublished: "2020-08-24T12:42:45",
      dateReserved: "2020-06-17T00:00:00",
      dateUpdated: "2024-08-04T12:39:36.524Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-10208

Vulnerability from cvelistv5

Published

2019-10-29 13:13

Modified

2024-08-04 22:17

Severity ?

7.5 (High) - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.

References

▼	URL	Tags
	https://www.postgresql.org/about/news/1960/	x_refsource_MISC
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10208	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	PostgreSQL	postgresql	Version: all 11.x before 11.5 Version: all 10.x before 10.10 Version: all 9.6.x before 9.6.15 Version: all 9.5.x before 9.5.19 Version: all 9.4.x before 9.4.24

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T22:17:18.925Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.postgresql.org/about/news/1960/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10208",
               },
               {
                  name: "openSUSE-SU-2020:1227",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "postgresql",
               vendor: "PostgreSQL",
               versions: [
                  {
                     status: "affected",
                     version: "all 11.x before 11.5",
                  },
                  {
                     status: "affected",
                     version: "all 10.x before 10.10",
                  },
                  {
                     status: "affected",
                     version: "all 9.6.x before 9.6.15",
                  },
                  {
                     status: "affected",
                     version: "all 9.5.x before 9.5.19",
                  },
                  {
                     status: "affected",
                     version: "all 9.4.x before 9.4.24",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-89",
                     description: "CWE-89",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-08-17T17:06:11",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.postgresql.org/about/news/1960/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10208",
            },
            {
               name: "openSUSE-SU-2020:1227",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2019-10208",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "postgresql",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "all 11.x before 11.5",
                                       },
                                       {
                                          version_value: "all 10.x before 10.10",
                                       },
                                       {
                                          version_value: "all 9.6.x before 9.6.15",
                                       },
                                       {
                                          version_value: "all 9.5.x before 9.5.19",
                                       },
                                       {
                                          version_value: "all 9.4.x before 9.4.24",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "PostgreSQL",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "7.5/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-89",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.postgresql.org/about/news/1960/",
                     refsource: "MISC",
                     url: "https://www.postgresql.org/about/news/1960/",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10208",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10208",
                  },
                  {
                     name: "openSUSE-SU-2020:1227",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2019-10208",
      datePublished: "2019-10-29T13:13:12",
      dateReserved: "2019-03-27T00:00:00",
      dateUpdated: "2024-08-04T22:17:18.925Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14349

Vulnerability from cvelistv5

Published

2020-08-24 12:32

Modified

2024-08-04 12:39

Severity ?

Summary

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.

References

▼	URL	Tags
	http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html	vendor-advisory, x_refsource_SUSE
	https://bugzilla.redhat.com/show_bug.cgi?id=1865744	x_refsource_MISC
	https://security.gentoo.org/glsa/202008-13	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4472-1/	vendor-advisory, x_refsource_UBUNTU
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html	vendor-advisory, x_refsource_SUSE
	https://security.netapp.com/advisory/ntap-20200918-0002/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	PostgreSQL	Version: PostgreSQL versions before 12.4, before 11.9 and before 10.14

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:39:36.599Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "openSUSE-SU-2020:1228",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html",
               },
               {
                  name: "openSUSE-SU-2020:1244",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html",
               },
               {
                  name: "openSUSE-SU-2020:1243",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1865744",
               },
               {
                  name: "GLSA-202008-13",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202008-13",
               },
               {
                  name: "USN-4472-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/4472-1/",
               },
               {
                  name: "openSUSE-SU-2020:1312",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html",
               },
               {
                  name: "openSUSE-SU-2020:1326",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20200918-0002/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "PostgreSQL",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "PostgreSQL versions before 12.4, before 11.9 and before 10.14",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Improper Input Validation",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-09-18T11:06:17",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "openSUSE-SU-2020:1228",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html",
            },
            {
               name: "openSUSE-SU-2020:1244",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html",
            },
            {
               name: "openSUSE-SU-2020:1243",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1865744",
            },
            {
               name: "GLSA-202008-13",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202008-13",
            },
            {
               name: "USN-4472-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/4472-1/",
            },
            {
               name: "openSUSE-SU-2020:1312",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html",
            },
            {
               name: "openSUSE-SU-2020:1326",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20200918-0002/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2020-14349",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "PostgreSQL",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "PostgreSQL versions before 12.4, before 11.9 and before 10.14",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Improper Input Validation",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "openSUSE-SU-2020:1228",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00044.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1244",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00049.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1243",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00050.html",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1865744",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1865744",
                  },
                  {
                     name: "GLSA-202008-13",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202008-13",
                  },
                  {
                     name: "USN-4472-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/4472-1/",
                  },
                  {
                     name: "openSUSE-SU-2020:1312",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00003.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1326",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00008.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20200918-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20200918-0002/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-14349",
      datePublished: "2020-08-24T12:32:13",
      dateReserved: "2020-06-17T00:00:00",
      dateUpdated: "2024-08-04T12:39:36.599Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_opensuse

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature