Red Hat Security AdvisoryRHSA-2017:2860
postgresql security update
Released 2017-10-05 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) postgresql-8.4.20-8.el6_9, postgresql-libs-8.4.20-8.el6_9
- Red Hat Enterprise Linux Desktop Optional (v. 6) postgresql-8.4.20-8.el6_9, postgresql-contrib-8.4.20-8.el6_9, postgresql-devel-8.4.20-8.el6_9 +6
- Red Hat Enterprise Linux HPC Node (v. 6) postgresql-8.4.20-8.el6_9, postgresql-libs-8.4.20-8.el6_9
- Red Hat Enterprise Linux HPC Node Optional (v. 6) postgresql-contrib-8.4.20-8.el6_9, postgresql-devel-8.4.20-8.el6_9, postgresql-docs-8.4.20-8.el6_9 +5
- Red Hat Enterprise Linux Server (v. 6) postgresql-8.4.20-8.el6_9, postgresql-8.4.20-8.el6_9.ppc, postgresql-contrib-8.4.20-8.el6_9 +10
- Red Hat Enterprise Linux Workstation (v. 6) postgresql-8.4.20-8.el6_9, postgresql-contrib-8.4.20-8.el6_9, postgresql-devel-8.4.20-8.el6_9 +7
Fixes 1 record
Priority HIGH 77
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.61566 · Published 2017-08-16 · Partial fix · 9.2.22, 9.3.18 +3 CWE-287
