SUSE-SU-2026:22177-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-202622177-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22177-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2026:22177-1
- Upstream
CVE (8)
- CVE-2026-6472
- CVE-2026-6473
- CVE-2026-6474
- CVE-2026-6475
- CVE-2026-6477
- CVE-2026-6478
- CVE-2026-6479
- CVE-2026-6637
- Related
- Published
- 2026-06-19T16:51:37Z
- Modified
- 2026-06-24T18:24:18Z
- Summary
- Security update for postgresql14
- Details
-
This update for postgresql14 fixes the following issues
Security issues:
- CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
- CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
- CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
- CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
- CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
- CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
- CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
- CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
Non security issue:
- Update to version 14.23.
- Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and transactional updates (jsc#PED-14823).
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-202622177-1/
- https://bugzilla.suse.com/1263804
- https://bugzilla.suse.com/1265172
- https://bugzilla.suse.com/1265173
- https://bugzilla.suse.com/1265174
- https://bugzilla.suse.com/1265175
- https://bugzilla.suse.com/1265177
- https://bugzilla.suse.com/1265178
- https://bugzilla.suse.com/1265179
- https://bugzilla.suse.com/1265181
- https://www.suse.com/security/cve/CVE-2026-6472
- https://www.suse.com/security/cve/CVE-2026-6473
- https://www.suse.com/security/cve/CVE-2026-6474
- https://www.suse.com/security/cve/CVE-2026-6475
- https://www.suse.com/security/cve/CVE-2026-6477
- https://www.suse.com/security/cve/CVE-2026-6478
- https://www.suse.com/security/cve/CVE-2026-6479
- https://www.suse.com/security/cve/CVE-2026-6637
Affected packages
SUSE:Linux Enterprise Server 16.0 / postgresql14
Package
- Name
- postgresql14
- Purl
- pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%2016.0
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed14.23-160000.1.1
Ecosystem specific
{
"binaries": [
{
"postgresql14": "14.23-160000.1.1",
"postgresql14-contrib": "14.23-160000.1.1",
"postgresql14-devel": "14.23-160000.1.1",
"postgresql14-docs": "14.23-160000.1.1",
"postgresql14-plperl": "14.23-160000.1.1",
"postgresql14-plpython": "14.23-160000.1.1",
"postgresql14-pltcl": "14.23-160000.1.1",
"postgresql14-server": "14.23-160000.1.1",
"postgresql14-server-devel": "14.23-160000.1.1"
}
]
}
SUSE:Linux Enterprise Server for SAP applications 16.0 / postgresql14
Package
- Name
- postgresql14
- Purl
- pkg:rpm/suse/postgresql14&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed14.23-160000.1.1
Ecosystem specific
{
"binaries": [
{
"postgresql14": "14.23-160000.1.1",
"postgresql14-contrib": "14.23-160000.1.1",
"postgresql14-devel": "14.23-160000.1.1",
"postgresql14-docs": "14.23-160000.1.1",
"postgresql14-plperl": "14.23-160000.1.1",
"postgresql14-plpython": "14.23-160000.1.1",
"postgresql14-pltcl": "14.23-160000.1.1",
"postgresql14-server": "14.23-160000.1.1",
"postgresql14-server-devel": "14.23-160000.1.1"
}
]
}