Issued:
2021-01-18
Updated:
2021-01-18

RHSA-2021:0165 - Security Advisory

Synopsis

Important: libpq security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for libpq is now available for Red Hat Enterprise Linux 8.1 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers.

The following packages have been upgraded to a later upstream version: libpq (12.5). (BZ#1898226, BZ#1901561)

Security Fix(es):

  • postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)
  • postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1 x86_64

Fixes

  • BZ - 1894423 - CVE-2020-25694 postgresql: Reconnection can downgrade connection security settings
  • BZ - 1894430 - CVE-2020-25696 postgresql: psql's \gset allows overwriting specially treated variables

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1

SRPM
libpq-12.5-2.el8_1.src.rpm SHA-256: c62a8f9de331892a3705b09508d09b54df1db58376360b0cc4062bc6bc95b021
x86_64
libpq-12.5-2.el8_1.i686.rpm SHA-256: 9791d110d66f26a3d504da141cdd0922455505bf641ec0a1c03bcb5b8bc4df56
libpq-12.5-2.el8_1.x86_64.rpm SHA-256: 4c1b7d3d56201388afc4b42256419a9292ba15a97b64199e954c5e00316dbcb7
libpq-debuginfo-12.5-2.el8_1.i686.rpm SHA-256: ce27ea6f2c48f4ebbaf5c42f51007f65f86935359a921e1fccb8970c4dd3c146
libpq-debuginfo-12.5-2.el8_1.x86_64.rpm SHA-256: 9ad634499d8215d2a8138ef504fc5925f611f3487ba167046f5cb8e87a54b971
libpq-debugsource-12.5-2.el8_1.i686.rpm SHA-256: c5b1c93e3d4a448b8ca32972da257b124644e5c0d8a0a320571d9703a85fe5b3
libpq-debugsource-12.5-2.el8_1.x86_64.rpm SHA-256: 1bd122e9215c579e90d067ba5684510bc6d8f996098358828e682438618508ce
libpq-devel-12.5-2.el8_1.i686.rpm SHA-256: 1e79af9cb9bc2151d40cdaa46e830ddc357427f59bdadacf4830a34edf998ec4
libpq-devel-12.5-2.el8_1.x86_64.rpm SHA-256: f5ef0f549ce265d005f1df843f824aaa58d297f52fba3186573509ab2bab7df7
libpq-devel-debuginfo-12.5-2.el8_1.i686.rpm SHA-256: 7531433c73d2b70604d3948415054480481446c32614ffbbe28e617fe7836a3f
libpq-devel-debuginfo-12.5-2.el8_1.x86_64.rpm SHA-256: 6dce6d8b310ec38787ec3c925774fabc1763288e9b131cf0d8e3abb0840dc167

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1

SRPM
libpq-12.5-2.el8_1.src.rpm SHA-256: c62a8f9de331892a3705b09508d09b54df1db58376360b0cc4062bc6bc95b021
s390x
libpq-12.5-2.el8_1.s390x.rpm SHA-256: 6ad3c4b705594519aa47d2f17c5402857af9e7b6140f08c9b57205398261d2b8
libpq-debuginfo-12.5-2.el8_1.s390x.rpm SHA-256: ffb541d354e93fe2db2dae98ee7c77b79ef383fc41310a6cc6ffa9c1ea4e6f95
libpq-debugsource-12.5-2.el8_1.s390x.rpm SHA-256: 0e239db109144266b35d9e0fed109ff73f57eabfde8f71071345e041e47e1465
libpq-devel-12.5-2.el8_1.s390x.rpm SHA-256: cbec47ae2cd069d824c55c8a46614d5d522e3f747386a4c27b50ec7282bead9e
libpq-devel-debuginfo-12.5-2.el8_1.s390x.rpm SHA-256: 3688c46b5c014fd9fbc25d90f4af66b206de5a14c5c109fd9db8c842b7f053ab

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1

SRPM
libpq-12.5-2.el8_1.src.rpm SHA-256: c62a8f9de331892a3705b09508d09b54df1db58376360b0cc4062bc6bc95b021
ppc64le
libpq-12.5-2.el8_1.ppc64le.rpm SHA-256: ee3dd3869bf940026ef839a288700bc9087bbc1d4f33b62fb2a1b0b0ab92a726
libpq-debuginfo-12.5-2.el8_1.ppc64le.rpm SHA-256: 32ce7338213c04874632c2e9704d457576e458b29137abd6ae710977215f12ef
libpq-debugsource-12.5-2.el8_1.ppc64le.rpm SHA-256: 8e2758c3236afe12c58ef9d89e8371a97d9d6d2cd60282c58af74d375af97056
libpq-devel-12.5-2.el8_1.ppc64le.rpm SHA-256: c2b99c27a095925bf8a4ba92fdcea4128f34478579d81ecef4e2285630ae9041
libpq-devel-debuginfo-12.5-2.el8_1.ppc64le.rpm SHA-256: 7909c8616d5a8fe92fd15b65720b77df6348a2f3bbb20cf8f5832ccf5dbe4457

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1

SRPM
libpq-12.5-2.el8_1.src.rpm SHA-256: c62a8f9de331892a3705b09508d09b54df1db58376360b0cc4062bc6bc95b021
aarch64
libpq-12.5-2.el8_1.aarch64.rpm SHA-256: 5a92da1683383e887328b2492fe376015122828b03d3facfc731d4fd02783961
libpq-debuginfo-12.5-2.el8_1.aarch64.rpm SHA-256: bf70e274965988498afeb2fd332bc1d224b1c6c1bfa32d33db2beb52a71acba4
libpq-debugsource-12.5-2.el8_1.aarch64.rpm SHA-256: 83e9f9051be238fb1f2f38442b0481897dec00093e07129586aee84ea9104bab
libpq-devel-12.5-2.el8_1.aarch64.rpm SHA-256: 5a9af163753ade57459d4d8509aad4283082423069e5986e85573a1f8c7a18cb
libpq-devel-debuginfo-12.5-2.el8_1.aarch64.rpm SHA-256: 12f4fe6533e67713f6b41ad5e1984cb3d7cda5a26d04a4c3f52bfe4d824787c5

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1

SRPM
libpq-12.5-2.el8_1.src.rpm SHA-256: c62a8f9de331892a3705b09508d09b54df1db58376360b0cc4062bc6bc95b021
ppc64le
libpq-12.5-2.el8_1.ppc64le.rpm SHA-256: ee3dd3869bf940026ef839a288700bc9087bbc1d4f33b62fb2a1b0b0ab92a726
libpq-debuginfo-12.5-2.el8_1.ppc64le.rpm SHA-256: 32ce7338213c04874632c2e9704d457576e458b29137abd6ae710977215f12ef
libpq-debugsource-12.5-2.el8_1.ppc64le.rpm SHA-256: 8e2758c3236afe12c58ef9d89e8371a97d9d6d2cd60282c58af74d375af97056
libpq-devel-12.5-2.el8_1.ppc64le.rpm SHA-256: c2b99c27a095925bf8a4ba92fdcea4128f34478579d81ecef4e2285630ae9041
libpq-devel-debuginfo-12.5-2.el8_1.ppc64le.rpm SHA-256: 7909c8616d5a8fe92fd15b65720b77df6348a2f3bbb20cf8f5832ccf5dbe4457

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1

SRPM
libpq-12.5-2.el8_1.src.rpm SHA-256: c62a8f9de331892a3705b09508d09b54df1db58376360b0cc4062bc6bc95b021
x86_64
libpq-12.5-2.el8_1.i686.rpm SHA-256: 9791d110d66f26a3d504da141cdd0922455505bf641ec0a1c03bcb5b8bc4df56
libpq-12.5-2.el8_1.x86_64.rpm SHA-256: 4c1b7d3d56201388afc4b42256419a9292ba15a97b64199e954c5e00316dbcb7
libpq-debuginfo-12.5-2.el8_1.i686.rpm SHA-256: ce27ea6f2c48f4ebbaf5c42f51007f65f86935359a921e1fccb8970c4dd3c146
libpq-debuginfo-12.5-2.el8_1.x86_64.rpm SHA-256: 9ad634499d8215d2a8138ef504fc5925f611f3487ba167046f5cb8e87a54b971
libpq-debugsource-12.5-2.el8_1.i686.rpm SHA-256: c5b1c93e3d4a448b8ca32972da257b124644e5c0d8a0a320571d9703a85fe5b3
libpq-debugsource-12.5-2.el8_1.x86_64.rpm SHA-256: 1bd122e9215c579e90d067ba5684510bc6d8f996098358828e682438618508ce
libpq-devel-12.5-2.el8_1.i686.rpm SHA-256: 1e79af9cb9bc2151d40cdaa46e830ddc357427f59bdadacf4830a34edf998ec4
libpq-devel-12.5-2.el8_1.x86_64.rpm SHA-256: f5ef0f549ce265d005f1df843f824aaa58d297f52fba3186573509ab2bab7df7
libpq-devel-debuginfo-12.5-2.el8_1.i686.rpm SHA-256: 7531433c73d2b70604d3948415054480481446c32614ffbbe28e617fe7836a3f
libpq-devel-debuginfo-12.5-2.el8_1.x86_64.rpm SHA-256: 6dce6d8b310ec38787ec3c925774fabc1763288e9b131cf0d8e3abb0840dc167

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.