Red Hat Security AdvisoryRHSA-2017:1983
postgresql security and enhancement update
Released 2017-08-01 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) postgresql-9.2.21-1.el7, postgresql-libs-9.2.21-1.el7
- Red Hat Enterprise Linux Client Optional (v. 7) postgresql-9.2.21-1.el7, postgresql-contrib-9.2.21-1.el7, postgresql-devel-9.2.21-1.el7 +8
- Red Hat Enterprise Linux ComputeNode (v. 7) postgresql-9.2.21-1.el7, postgresql-libs-9.2.21-1.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) postgresql-9.2.21-1.el7, postgresql-contrib-9.2.21-1.el7, postgresql-devel-9.2.21-1.el7 +8
- Red Hat Enterprise Linux Server (v. 7) postgresql-9.2.21-1.el7, postgresql-9.2.21-1.el7.ppc, postgresql-contrib-9.2.21-1.el7 +10
- Red Hat Enterprise Linux Server Optional (v. 7) postgresql-static-9.2.21-1.el7, postgresql-static-9.2.21-1.el7.ppc, postgresql-upgrade-9.2.21-1.el7
- Red Hat Enterprise Linux Workstation (v. 7) postgresql-9.2.21-1.el7, postgresql-contrib-9.2.21-1.el7, postgresql-devel-9.2.21-1.el7 +7
- Red Hat Enterprise Linux Workstation Optional (v. 7) postgresql-static-9.2.21-1.el7, postgresql-upgrade-9.2.21-1.el7
Fixes 2 records
Priority MEDIUM 42
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.06331 · Published 2017-05-12 · Partial fix CWE-522
Priority LOW 38
It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing inf…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.0256 · Published 2017-05-12 · Partial fix CWE-285
