Red Hat Security Advisory

RHSA-2018:2565

rh-postgresql10-postgresql security update

Released 2018-08-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-postgresql10-postgresql-10.5-1.el7, rh-postgresql10-postgresql-contrib-10.5-1.el7, rh-postgresql10-postgresql-contrib-syspaths-10.5-1.el7 +11
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-postgresql10-postgresql-10.5-1.el7, rh-postgresql10-postgresql-contrib-10.5-1.el7, rh-postgresql10-postgresql-contrib-syspaths-10.5-1.el7 +11
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-postgresql10-postgresql-10.5-1.el7, rh-postgresql10-postgresql-contrib-10.5-1.el7, rh-postgresql10-postgresql-contrib-syspaths-10.5-1.el7 +11
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-postgresql10-postgresql-10.5-1.el7, rh-postgresql10-postgresql-contrib-10.5-1.el7, rh-postgresql10-postgresql-contrib-syspaths-10.5-1.el7 +11
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-postgresql10-postgresql-10.5-1.el7, rh-postgresql10-postgresql-contrib-10.5-1.el7, rh-postgresql10-postgresql-contrib-syspaths-10.5-1.el7 +11

Fixes 3 records

TI-2018-01033 CVE-2018-1115 · GHSA-54w7-jv4g-qhqg

Incorrect permission assignment in postgresql

MEDIUM 52

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.03826 Published 2018-05-10 Partial fix CWE-732

TI-2018-07727 CVE-2018-10915 · GHSA-q7vw-gjh3-qf97

Information disclosure in postgresql

MEDIUM 45

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections.

CVSS 3.0HIGH 8.5 Network Low privileges No interaction EPSS 0.05089 Published 2018-08-09 Partial fix CWE-200

TI-2018-07737 CVE-2018-10925 · GHSA-mr45-mwhc-fw72

Incorrect authorization in postgresql

MEDIUM 40

It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ...

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.02241 Published 2018-08-09 Partial fix CWE-863