postgresql:12 security update

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version:
postgresql (12.5).

Security Fix(es):

* postgresql: Reconnection can downgrade connection security settings
(CVE-2020-25694)

* postgresql: Multiple features escape "security restricted operation" sandbox
(CVE-2020-25695)

* postgresql: Uncontrolled search path element in logical replication
(CVE-2020-14349)

* postgresql: Uncontrolled search path element in CREATE EXTENSION
(CVE-2020-14350)

* postgresql: psql's \gset allows overwriting specially treated variables
(CVE-2020-25696)

* postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks
(CVE-2020-1720)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

CVE-2020-14349
It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14
did not properly sanitize the search_path during logical replication. An
authenticated attacker could use this flaw in an attack similar to
CVE-2018-1058, in order to execute arbitrary SQL command in the context of the
user used for replication.
CVE-2020-14350
It was found that some PostgreSQL extensions did not use search_path safely in
their installation script. An attacker with sufficient privileges could use this
flaw to trick an administrator into executing a specially crafted script, during
the installation or update of such extension. This affects PostgreSQL versions
before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.
CVE-2020-1720
A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where
sub-commands did not perform authorization checks. An authenticated attacker
could use this flaw in certain configurations to perform drop objects such as
function, triggers, et al., leading to database corruption. This issue affects
PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.
CVE-2020-25694
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10,
before 10.15, before 9.6.20 and before 9.5.24. If a client application that
creates additional database connections only reuses the basic connection
parameters while dropping security-relevant parameters, an opportunity for a
man-in-the-middle attack, or the ability to observe clear-text transmissions,
could exist. The highest threat from this vulnerability is to data
confidentiality and integrity as well as system availability.
CVE-2020-25695
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10,
before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to
create non-temporary objects in at least one schema can execute arbitrary SQL
functions under the identity of a superuser. The highest threat from this
vulnerability is to data confidentiality and integrity as well as system
availability.
CVE-2020-25696
A flaw was found in the psql interactive terminal of PostgreSQL in versions
before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before
9.5.24. If an interactive psql session uses \gset when querying a compromised
server, the attacker can execute arbitrary code as the operating system account
running psql. The highest threat from this vulnerability is to data
confidentiality and integrity as well as system availability.

Modularity name: postgresql
Stream name: 12