Bug 1067841 – VUL-0: CVE-2017-15099: postgresql96: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges

Bug 1067841 - (CVE-2017-15099) VUL-0: CVE-2017-15099: postgresql96: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges

(CVE-2017-15099)
Summary:	VUL-0: CVE-2017-15099: postgresql96: INSERT ... ON CONFLICT DO UPDATE fails t...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/194756/
Whiteboard:	CVSSv3:SUSE:CVE-2017-15099:7.8:(AV:L/...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2017-11-13 10:51 UTC by Marcus Meissner
Modified:	2018-10-02 08:45 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Marcus Meissner 2017-11-13 10:51:31 UTC

CVE-2017-15099

CVE-2017-15099: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges

Prior to this release, the "INSERT ... ON CONFLICT DO UPDATE" would not check to see if the executing user had permission to perform a "SELECT" on the index performing the conflicting check. Additionally, in a table with row-level security enabled, the "INSERT ... ON CONFLICT DO UPDATE" would not check the SELECT policies for that table before performing the update.

This fix ensures that "INSERT ... ON CONFLICT DO UPDATE" checks against table permissions and RLS policies before executing.

References:

http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15099.html
http://www.debian.org/security/2017/dsa-4028

Comment 1 Marcus Meissner 2017-11-13 10:51:59 UTC

feature introduced in 9.5 I think.

Comment 2 Bernhard Wiedemann 2017-12-06 10:10:06 UTC

This is an autogenerated message for OBS integration:
This bug (1067841) was mentioned in
https://build.opensuse.org/request/show/554740 Factory / postgresql96

Comment 4 Swamp Workflow Management 2017-12-21 11:09:39 UTC

SUSE-SU-2017:3391-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1067841,1067844
CVE References: CVE-2017-15098,CVE-2017-15099
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    postgresql96-libs-9.6.6-3.10.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    postgresql96-libs-9.6.6-3.10.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    postgresql96-9.6.6-3.10.1, postgresql96-libs-9.6.6-3.10.1
SUSE Linux Enterprise Server 12-SP3 (src):    postgresql96-9.6.6-3.10.1, postgresql96-libs-9.6.6-3.10.1
SUSE Linux Enterprise Server 12-SP2 (src):    postgresql96-9.6.6-3.10.1, postgresql96-libs-9.6.6-3.10.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    postgresql96-9.6.6-3.10.1, postgresql96-libs-9.6.6-3.10.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    postgresql96-9.6.6-3.10.1, postgresql96-libs-9.6.6-3.10.1

Comment 5 Andreas Stieger 2017-12-22 15:52:21 UTC

done

Comment 6 Swamp Workflow Management 2017-12-22 20:17:53 UTC

openSUSE-SU-2017:3425-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1067841,1067844
CVE References: CVE-2017-15098,CVE-2017-15099
Sources used:
openSUSE Leap 42.3 (src):    postgresql96-9.6.6-9.1, postgresql96-libs-9.6.6-9.1
openSUSE Leap 42.2 (src):    postgresql96-9.6.6-8.1, postgresql96-libs-9.6.6-8.1

Comment 7 Swamp Workflow Management 2018-02-09 13:40:10 UTC

This is an autogenerated message for OBS integration:
This bug (1067841) was mentioned in
https://build.opensuse.org/request/show/574651 Factory / postgresql95

Comment 8 Swamp Workflow Management 2018-02-21 13:40:23 UTC

This is an autogenerated message for OBS integration:
This bug (1067841) was mentioned in
https://build.opensuse.org/request/show/578690 42.3 / postgresql95

Comment 9 Swamp Workflow Management 2018-02-22 23:09:03 UTC

openSUSE-SU-2018:0529-1: An update that solves 6 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1051684,1051685,1053259,1067841,1067844,1077983,1079757
CVE References: CVE-2017-15098,CVE-2017-15099,CVE-2017-7546,CVE-2017-7547,CVE-2017-7548,CVE-2018-1053
Sources used:
openSUSE Leap 42.3 (src):    postgresql95-9.5.11-2.3.1, postgresql95-libs-9.5.11-2.3.1