Red Hat Security Advisory

RHSA-2017:2425

rh-postgresql95-postgresql security update

Released 2017-08-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Satellite 5.7 (RHEL v.6) rh-postgresql95-postgresql-9.5.7-2.el6, rh-postgresql95-postgresql-contrib-9.5.7-2.el6, rh-postgresql95-postgresql-libs-9.5.7-2.el6 +32
Red Hat Satellite Managed DB 5.7 (RHEL v.6) rh-postgresql95-postgresql-9.5.7-2.el6, rh-postgresql95-postgresql-contrib-9.5.7-2.el6, rh-postgresql95-postgresql-libs-9.5.7-2.el6 +8

Fixes 5 records

TI-2016-04699 CVE-2016-5423 · GHSA-h824-5q6w-q27x

PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9…

MEDIUM 45

PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), ob…

CVSS 3.0HIGH 8.3 Network Low privileges No interaction EPSS 0.05962 Published 2016-12-09 Partial fix CWE-476

TI-2017-05132 CVE-2017-7486 · GHSA-cxxw-q5xv-pww9

Insufficiently protected credentials in PostgreSQL

MEDIUM 42

PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.06331 Published 2017-05-12 Partial fix CWE-522

TI-2016-04700 CVE-2016-5424 · GHSA-9j99-5j9q-2gmp

PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9…

LOW 39

PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via…

CVSS 3.0HIGH 7.1 Network Low privileges User interaction EPSS 0.04612 Published 2016-12-09 Partial fix CWE-94

TI-2017-05130 CVE-2017-7484 · GHSA-pwf5-pc7m-6hp4

Improper authorization in PostgreSQL

LOW 38

It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing inf…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0256 Published 2017-05-12 Partial fix CWE-285

TI-2017-05131 CVE-2017-7485 · GHSA-742m-4pjq-x8qf

In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x…

LOW 30

In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL ser…

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.02042 Published 2017-05-12 Partial fix CWE-390