Red Hat Product Errata RHSA-2020:3176 - Security Advisory

Issued:: 2020-07-28
Updated:: 2020-07-28

RHSA-2020:3176 - Security Advisory

Overview
Updated Packages

Synopsis

Important: postgresql-jdbc security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for postgresql-jdbc is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 04 August 2020]
This advisory has been updated with a reference to the Red Hat Knowledgebase article 5266441. This update does not change the packages in any way.

Description

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.

Security Fix(es):

postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML (CVE-2020-13692)

This update introduces a backwards incompatible change required to resolve this issue. Refer to the Red Hat Knowledgebase article 5266441 linked to in the References section for information on how to re-enable the old insecure behavior.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

Red Hat Enterprise Linux for x86_64 8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2 x86_64
Red Hat Enterprise Linux Server - AUS 8.6 x86_64
Red Hat Enterprise Linux Server - AUS 8.4 x86_64
Red Hat Enterprise Linux Server - AUS 8.2 x86_64
Red Hat Enterprise Linux for IBM z Systems 8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.2 s390x
Red Hat Enterprise Linux for Power, little endian 8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.2 ppc64le
Red Hat Enterprise Linux Server - TUS 8.6 x86_64
Red Hat Enterprise Linux Server - TUS 8.4 x86_64
Red Hat Enterprise Linux Server - TUS 8.2 x86_64
Red Hat Enterprise Linux for ARM 64 8 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.2 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2 ppc64le
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2 x86_64

Fixes

BZ - 1852985 - CVE-2020-13692 postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML

CVEs

CVE-2020-13692

References

Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux for x86_64 8

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
x86_64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
x86_64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
x86_64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
x86_64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux Server - AUS 8.6

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
x86_64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux Server - AUS 8.4

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
x86_64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux Server - AUS 8.2

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
x86_64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
s390x
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
s390x
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
s390x
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.2

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
s390x
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for Power, little endian 8

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
ppc64le
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
ppc64le
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
ppc64le
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.2

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
ppc64le
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux Server - TUS 8.6

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
x86_64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux Server - TUS 8.4

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
x86_64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux Server - TUS 8.2

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
x86_64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for ARM 64 8

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
aarch64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
aarch64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
aarch64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.2

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
aarch64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
ppc64le
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
ppc64le
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
ppc64le
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
x86_64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
x86_64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2

SRPM
postgresql-jdbc-42.2.3-3.el8_2.src.rpm	SHA-256: 7fabeeb77800bd08103a899cdd4707419fb8c8a62d02cfaa49034baafcb37440
x86_64
postgresql-jdbc-42.2.3-3.el8_2.noarch.rpm	SHA-256: 51cfe484dfa65e1398c885f84f691440b7c03c59b88d0833874c31cb01a6f4fe
postgresql-jdbc-javadoc-42.2.3-3.el8_2.noarch.rpm	SHA-256: f1aaa31ebb3cbce05c63afe384a5dba0ca97a407d8c6c921b33149d47a478c20

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.