Red Hat Security Advisory

RHSA-2017:2678

rh-postgresql94-postgresql security update

Released 2017-09-12 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-postgresql94-postgresql-9.4.14-1.el6, rh-postgresql94-postgresql-contrib-9.4.14-1.el6, rh-postgresql94-postgresql-devel-9.4.14-1.el6 +9
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-postgresql94-postgresql-9.4.14-1.el7, rh-postgresql94-postgresql-contrib-9.4.14-1.el7, rh-postgresql94-postgresql-devel-9.4.14-1.el7 +9
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-postgresql94-postgresql-9.4.14-1.el6, rh-postgresql94-postgresql-contrib-9.4.14-1.el6, rh-postgresql94-postgresql-devel-9.4.14-1.el6 +9
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-postgresql94-postgresql-9.4.14-1.el7, rh-postgresql94-postgresql-contrib-9.4.14-1.el7, rh-postgresql94-postgresql-devel-9.4.14-1.el7 +9
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-postgresql94-postgresql-9.4.14-1.el6, rh-postgresql94-postgresql-contrib-9.4.14-1.el6, rh-postgresql94-postgresql-devel-9.4.14-1.el6 +9
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-postgresql94-postgresql-9.4.14-1.el7, rh-postgresql94-postgresql-contrib-9.4.14-1.el7, rh-postgresql94-postgresql-devel-9.4.14-1.el7 +9

Fixes 3 records

TI-2017-05187 CVE-2017-7546 · GHSA-cj69-7h9j-r3j5

Improper authentication in postgresql

HIGH 77

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.61566 Published 2017-08-16 Partial fix · 9.2.22, 9.3.18 +3 CWE-287

TI-2017-05188 CVE-2017-7547 · GHSA-gx5r-vvjw-c75c

Insufficiently protected credentials in postgresql

MEDIUM 47

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server o…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.05581 Published 2017-08-16 Partial fix · 9.2.22, 9.3.18 +3 CWE-522

TI-2017-05189 CVE-2017-7548 · GHSA-mmxj-523q-gvxr

Missing authorization in postgresql

LOW 39

PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulti…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03517 Published 2017-08-16 Fixed in 9.4.13, 9.5.8 +1 CWE-862