Red Hat Security AdvisoryRHSA-2017:1678
rh-postgresql94-postgresql security update
Released 2017-07-05 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-postgresql94-postgresql-9.4.12-1.el6, rh-postgresql94-postgresql-contrib-9.4.12-1.el6, rh-postgresql94-postgresql-devel-9.4.12-1.el6 +9
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-postgresql94-postgresql-9.4.12-1.el7, rh-postgresql94-postgresql-contrib-9.4.12-1.el7, rh-postgresql94-postgresql-devel-9.4.12-1.el7 +9
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-postgresql94-postgresql-9.4.12-1.el6, rh-postgresql94-postgresql-contrib-9.4.12-1.el6, rh-postgresql94-postgresql-devel-9.4.12-1.el6 +9
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-postgresql94-postgresql-9.4.12-1.el7, rh-postgresql94-postgresql-contrib-9.4.12-1.el7, rh-postgresql94-postgresql-devel-9.4.12-1.el7 +9
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-postgresql94-postgresql-9.4.12-1.el6, rh-postgresql94-postgresql-contrib-9.4.12-1.el6, rh-postgresql94-postgresql-devel-9.4.12-1.el6 +9
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-postgresql94-postgresql-9.4.12-1.el7, rh-postgresql94-postgresql-contrib-9.4.12-1.el7, rh-postgresql94-postgresql-devel-9.4.12-1.el7 +9
Fixes 3 records
Priority MEDIUM 42
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.06331 · Published 2017-05-12 · Partial fix CWE-522
Priority LOW 38
It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing inf…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.0256 · Published 2017-05-12 · Partial fix CWE-285
Priority LOW 30
In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL ser…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.02042 · Published 2017-05-12 · Partial fix CWE-390
THREATIST.IORead the docs