Red Hat Security AdvisoryRHSA-2017:2728
postgresql security update
Released 2017-09-14 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) postgresql-9.2.23-1.el7_4, postgresql-libs-9.2.23-1.el7_4
- Red Hat Enterprise Linux Client Optional (v. 7) postgresql-9.2.23-1.el7_4, postgresql-contrib-9.2.23-1.el7_4, postgresql-devel-9.2.23-1.el7_4 +8
- Red Hat Enterprise Linux ComputeNode (v. 7) postgresql-9.2.23-1.el7_4, postgresql-libs-9.2.23-1.el7_4
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) postgresql-9.2.23-1.el7_4, postgresql-contrib-9.2.23-1.el7_4, postgresql-devel-9.2.23-1.el7_4 +8
- Red Hat Enterprise Linux Server (v. 7) postgresql-9.2.23-1.el7_4, postgresql-9.2.23-1.el7_4.ppc, postgresql-contrib-9.2.23-1.el7_4 +10
- Red Hat Enterprise Linux Server Optional (v. 7) postgresql-static-9.2.23-1.el7_4, postgresql-static-9.2.23-1.el7_4.ppc, postgresql-upgrade-9.2.23-1.el7_4
- Red Hat Enterprise Linux Workstation (v. 7) postgresql-9.2.23-1.el7_4, postgresql-contrib-9.2.23-1.el7_4, postgresql-devel-9.2.23-1.el7_4 +7
- Red Hat Enterprise Linux Workstation Optional (v. 7) postgresql-static-9.2.23-1.el7_4, postgresql-upgrade-9.2.23-1.el7_4
Fixes 2 records
Priority HIGH 77
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.61566 · Published 2017-08-16 · Partial fix · 9.2.22, 9.3.18 +3 CWE-287
Priority MEDIUM 47
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server o…
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.05581 · Published 2017-08-16 · Partial fix · 9.2.22, 9.3.18 +3 CWE-522
