<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for postgresql12</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2020:2018-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2020-11-25T20:08:45Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2020-11-25T20:08:45Z</InitialReleaseDate>
    <CurrentReleaseDate>2020-11-25T20:08:45Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for postgresql12</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for postgresql12 fixes the following issues:

- Upgrade to version 12.5:
  * CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ... WITH HOLD
    and firing of deferred triggers within index expressions and
    materialized view queries.
  * CVE-2020-25694, bsc#1178667:
    a) Fix usage of complex connection-string parameters in pg_dump,
    pg_restore, clusterdb, reindexdb, and vacuumdb.
    b) When psql's \connect command re-uses connection parameters,
    ensure that all non-overridden parameters from a previous
    connection string are re-used.
  * CVE-2020-25696, bsc#1178668: Prevent psql's \gset command from
    modifying specially-treated variables.
  * Fix recently-added timetz test case so it works when the USA
    is not observing daylight savings time.
  * https://www.postgresql.org/about/news/2111/
  * https://www.postgresql.org/docs/12/release-12-5.html

This update was imported from the SUSE:SLE-15-SP1:Update update project.</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">openSUSE-2020-2018</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/POYD3IAUBQT7S6ZQCAA74X6IBDUAZLMP/</URL>
      <Description>E-Mail link for openSUSE-SU-2020:2018-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1178666</URL>
      <Description>SUSE Bug 1178666</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1178667</URL>
      <Description>SUSE Bug 1178667</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1178668</URL>
      <Description>SUSE Bug 1178668</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-25694/</URL>
      <Description>SUSE CVE CVE-2020-25694 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-25695/</URL>
      <Description>SUSE CVE CVE-2020-25695 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-25696/</URL>
      <Description>SUSE CVE CVE-2020-25696 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="openSUSE Leap 15.2">
      <Branch Type="Product Name" Name="openSUSE Leap 15.2">
        <FullProductName ProductID="openSUSE Leap 15.2" CPE="cpe:/o:opensuse:leap:15.2">openSUSE Leap 15.2</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libecpg6-12.5-lp152.3.10.1">
      <FullProductName ProductID="libecpg6-12.5-lp152.3.10.1">libecpg6-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libecpg6-32bit-12.5-lp152.3.10.1">
      <FullProductName ProductID="libecpg6-32bit-12.5-lp152.3.10.1">libecpg6-32bit-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpq5-12.5-lp152.3.10.1">
      <FullProductName ProductID="libpq5-12.5-lp152.3.10.1">libpq5-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpq5-32bit-12.5-lp152.3.10.1">
      <FullProductName ProductID="libpq5-32bit-12.5-lp152.3.10.1">libpq5-32bit-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql12-12.5-lp152.3.10.1">
      <FullProductName ProductID="postgresql12-12.5-lp152.3.10.1">postgresql12-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql12-contrib-12.5-lp152.3.10.1">
      <FullProductName ProductID="postgresql12-contrib-12.5-lp152.3.10.1">postgresql12-contrib-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql12-devel-12.5-lp152.3.10.1">
      <FullProductName ProductID="postgresql12-devel-12.5-lp152.3.10.1">postgresql12-devel-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql12-docs-12.5-lp152.3.10.1">
      <FullProductName ProductID="postgresql12-docs-12.5-lp152.3.10.1">postgresql12-docs-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql12-llvmjit-12.5-lp152.3.10.1">
      <FullProductName ProductID="postgresql12-llvmjit-12.5-lp152.3.10.1">postgresql12-llvmjit-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql12-plperl-12.5-lp152.3.10.1">
      <FullProductName ProductID="postgresql12-plperl-12.5-lp152.3.10.1">postgresql12-plperl-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql12-plpython-12.5-lp152.3.10.1">
      <FullProductName ProductID="postgresql12-plpython-12.5-lp152.3.10.1">postgresql12-plpython-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql12-pltcl-12.5-lp152.3.10.1">
      <FullProductName ProductID="postgresql12-pltcl-12.5-lp152.3.10.1">postgresql12-pltcl-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql12-server-12.5-lp152.3.10.1">
      <FullProductName ProductID="postgresql12-server-12.5-lp152.3.10.1">postgresql12-server-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql12-server-devel-12.5-lp152.3.10.1">
      <FullProductName ProductID="postgresql12-server-devel-12.5-lp152.3.10.1">postgresql12-server-devel-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="postgresql12-test-12.5-lp152.3.10.1">
      <FullProductName ProductID="postgresql12-test-12.5-lp152.3.10.1">postgresql12-test-12.5-lp152.3.10.1</FullProductName>
    </Branch>
    <Relationship ProductReference="libecpg6-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:libecpg6-12.5-lp152.3.10.1">libecpg6-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="libecpg6-32bit-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:libecpg6-32bit-12.5-lp152.3.10.1">libecpg6-32bit-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpq5-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:libpq5-12.5-lp152.3.10.1">libpq5-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpq5-32bit-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:libpq5-32bit-12.5-lp152.3.10.1">libpq5-32bit-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql12-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:postgresql12-12.5-lp152.3.10.1">postgresql12-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql12-contrib-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:postgresql12-contrib-12.5-lp152.3.10.1">postgresql12-contrib-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql12-devel-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:postgresql12-devel-12.5-lp152.3.10.1">postgresql12-devel-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql12-docs-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:postgresql12-docs-12.5-lp152.3.10.1">postgresql12-docs-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql12-llvmjit-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:postgresql12-llvmjit-12.5-lp152.3.10.1">postgresql12-llvmjit-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql12-plperl-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:postgresql12-plperl-12.5-lp152.3.10.1">postgresql12-plperl-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql12-plpython-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:postgresql12-plpython-12.5-lp152.3.10.1">postgresql12-plpython-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql12-pltcl-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:postgresql12-pltcl-12.5-lp152.3.10.1">postgresql12-pltcl-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql12-server-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:postgresql12-server-12.5-lp152.3.10.1">postgresql12-server-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql12-server-devel-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:postgresql12-server-devel-12.5-lp152.3.10.1">postgresql12-server-devel-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="postgresql12-test-12.5-lp152.3.10.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.2">
      <FullProductName ProductID="openSUSE Leap 15.2:postgresql12-test-12.5-lp152.3.10.1">postgresql12-test-12.5-lp152.3.10.1 as a component of openSUSE Leap 15.2</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.</Note>
    </Notes>
    <CVE>CVE-2020-25694</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 15.2:libecpg6-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:libecpg6-32bit-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:libpq5-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:libpq5-32bit-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-contrib-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-devel-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-docs-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-llvmjit-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-plperl-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-plpython-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-pltcl-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-server-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-server-devel-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-test-12.5-lp152.3.10.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/POYD3IAUBQT7S6ZQCAA74X6IBDUAZLMP/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-25694.html</URL>
        <Description>CVE-2020-25694</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178667</URL>
        <Description>SUSE Bug 1178667</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1179870</URL>
        <Description>SUSE Bug 1179870</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.</Note>
    </Notes>
    <CVE>CVE-2020-25695</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 15.2:libecpg6-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:libecpg6-32bit-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:libpq5-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:libpq5-32bit-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-contrib-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-devel-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-docs-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-llvmjit-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-plperl-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-plpython-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-pltcl-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-server-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-server-devel-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-test-12.5-lp152.3.10.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:S/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/POYD3IAUBQT7S6ZQCAA74X6IBDUAZLMP/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-25695.html</URL>
        <Description>CVE-2020-25695</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178666</URL>
        <Description>SUSE Bug 1178666</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.</Note>
    </Notes>
    <CVE>CVE-2020-25696</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 15.2:libecpg6-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:libecpg6-32bit-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:libpq5-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:libpq5-32bit-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-contrib-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-devel-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-docs-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-llvmjit-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-plperl-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-plpython-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-pltcl-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-server-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-server-devel-12.5-lp152.3.10.1</ProductID>
        <ProductID>openSUSE Leap 15.2:postgresql12-test-12.5-lp152.3.10.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.6</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:N/C:C/I:C/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/POYD3IAUBQT7S6ZQCAA74X6IBDUAZLMP/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-25696.html</URL>
        <Description>CVE-2020-25696</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178668</URL>
        <Description>SUSE Bug 1178668</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1179870</URL>
        <Description>SUSE Bug 1179870</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
