SUSE alert openSUSE-SU-2026:20131-1 (postgresql17 and postgresql18)

From:
             
 
null@suse.de
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:20131-1: important: Security update for postgresql17 and postgresql18
Date:
             
 
Tue, 03 Feb 2026 15:24:44 +0100
Message-ID:
             
 
<20260203142444.CC3ACFE86@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for postgresql17 and postgresql18
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:20131-1
Rating: important
References:

  * bsc#1253332
  * bsc#1253333



Cross-References:

  * CVE-2025-12817
  * CVE-2025-12818



CVSS scores:

  * CVE-2025-12817 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
  * CVE-2025-12817 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
  * CVE-2025-12818 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2025-12818 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed.

Description:

This update for postgresql17 and postgresql18 fixes the following issues:

Changes in postgresql17, postgresql18:

Update to 17.7:

* https://www.postgresql.org/about/news/p-3171/
* https://www.postgresql.org/docs/release/17.7/

* bsc#1253332, CVE-2025-12817: Missing check for CREATE
  privileges on the schema in CREATE STATISTICS allowed table
  owners to create statistics in any schema, potentially leading
  to unexpected naming conflicts.
* bsc#1253333, CVE-2025-12818: Several places in libpq were not
  sufficiently careful about computing the required size of a
  memory allocation. Sufficiently large inputs could cause
  integer overflow, resulting in an undersized buffer, which
  would then lead to writing past the end of the buffer.


Postgresql is shipped in version 18.1.

pgvector was updated to 0.8.1 to support postgresql18.

pgaudit was updated to support postgresql18.



Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-216=1

Package List:

- openSUSE Leap 16.0:

  libecpg6-18.1-160000.1.1
  libpq5-18.1-160000.1.1
  postgresql-18-160000.1.1
  postgresql-contrib-18-160000.1.1
  postgresql-devel-18-160000.1.1
  postgresql-docs-18-160000.1.1
  postgresql-llvmjit-18-160000.1.1
  postgresql-llvmjit-devel-18-160000.1.1
  postgresql-plperl-18-160000.1.1
  postgresql-plpython-18-160000.1.1
  postgresql-pltcl-18-160000.1.1
  postgresql-server-18-160000.1.1
  postgresql-server-devel-18-160000.1.1
  postgresql-test-18-160000.1.1
  postgresql13-pgaudit-1.5.3-160000.3.1
  postgresql13-pgvector-0.8.1-160000.1.1
  postgresql14-pgaudit-1.6.3-160000.3.1
  postgresql14-pgvector-0.8.1-160000.1.1
  postgresql15-pgaudit-1.7.1-160000.3.1
  postgresql15-pgvector-0.8.1-160000.1.1
  postgresql16-pgaudit-16.1-160000.3.1
  postgresql16-pgvector-0.8.1-160000.1.1
  postgresql17-17.7-160000.1.1
  postgresql17-contrib-17.7-160000.1.1
  postgresql17-devel-17.7-160000.1.1
  postgresql17-docs-17.7-160000.1.1
  postgresql17-llvmjit-17.7-160000.1.1
  postgresql17-llvmjit-devel-17.7-160000.1.1
  postgresql17-pgaudit-17.1-160000.3.1
  postgresql17-pgvector-0.8.1-160000.1.1
  postgresql17-plperl-17.7-160000.1.1
  postgresql17-plpython-17.7-160000.1.1
  postgresql17-pltcl-17.7-160000.1.1
  postgresql17-server-17.7-160000.1.1
  postgresql17-server-devel-17.7-160000.1.1
  postgresql17-test-17.7-160000.1.1
  postgresql18-18.1-160000.1.1
  postgresql18-contrib-18.1-160000.1.1
  postgresql18-devel-18.1-160000.1.1
  postgresql18-devel-mini-18.1-160000.1.1
  postgresql18-docs-18.1-160000.1.1
  postgresql18-llvmjit-18.1-160000.1.1
  postgresql18-llvmjit-devel-18.1-160000.1.1
  postgresql18-pgaudit-18.0-160000.3.1
  postgresql18-pgvector-0.8.1-160000.1.1
  postgresql18-plperl-18.1-160000.1.1
  postgresql18-plpython-18.1-160000.1.1
  postgresql18-pltcl-18.1-160000.1.1
  postgresql18-server-18.1-160000.1.1
  postgresql18-server-devel-18.1-160000.1.1
  postgresql18-test-18.1-160000.1.1

References:

  * https://www.suse.com/security/cve/CVE-2025-12817.html
  * https://www.suse.com/security/cve/CVE-2025-12818.html