Red Hat Security AdvisoryRHSA-2012:0678
postgresql and postgresql84 security update
Released 2012-05-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- RHEL Desktop Workstation (v. 5 client) postgresql84-8.4.11-1.el5_8, postgresql84-devel-8.4.11-1.el5_8, postgresql84-devel-8.4.11-1.el5_8.i386 +10
- Red Hat Enterprise Linux (v. 5 server) postgresql84-8.4.11-1.el5_8, postgresql84-8.4.11-1.el5_8.i386, postgresql84-8.4.11-1.el5_8.ia64 +45
- Red Hat Enterprise Linux Desktop (v. 5 client) postgresql84-8.4.11-1.el5_8, postgresql84-8.4.11-1.el5_8.i386, postgresql84-contrib-8.4.11-1.el5_8 +9
- Red Hat Enterprise Linux Desktop (v. 6) postgresql-8.4.11-1.el6_2, postgresql-libs-8.4.11-1.el6_2
- Red Hat Enterprise Linux Desktop Optional (v. 6) postgresql-8.4.11-1.el6_2, postgresql-contrib-8.4.11-1.el6_2, postgresql-devel-8.4.11-1.el6_2 +6
- Red Hat Enterprise Linux HPC Node (v. 6) postgresql-8.4.11-1.el6_2, postgresql-libs-8.4.11-1.el6_2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) postgresql-8.4.11-1.el6_2, postgresql-contrib-8.4.11-1.el6_2, postgresql-devel-8.4.11-1.el6_2 +6
- Red Hat Enterprise Linux Server (v. 6) postgresql-8.4.11-1.el6_2, postgresql-8.4.11-1.el6_2.ppc, postgresql-contrib-8.4.11-1.el6_2 +10
- Red Hat Enterprise Linux Workstation (v. 6) postgresql-8.4.11-1.el6_2, postgresql-contrib-8.4.11-1.el6_2, postgresql-devel-8.4.11-1.el6_2 +7
Fixes 3 records
Priority LOW 35
CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a cra…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.02653 · Published 2012-07-18 · Partial fix CWE-89
Priority LOW 35
CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER, which allows…
CVSS 2.0MEDIUM 6.5· Network · Low privileges · Interaction — · EPSS 0.03625 · Published 2012-07-18 · Partial fix CWE-264
Priority LOW 25
PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.02336 · Published 2012-07-18 · Partial fix CWE-20
THREATIST.IORead the docs