Red Hat Security Advisory

RHSA-2018:2566

rh-postgresql96-postgresql security update

Released 2018-08-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-postgresql96-postgresql-9.6.10-1.el6, rh-postgresql96-postgresql-contrib-9.6.10-1.el6, rh-postgresql96-postgresql-contrib-syspaths-9.6.10-1.el6 +11
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-postgresql96-postgresql-9.6.10-1.el7, rh-postgresql96-postgresql-contrib-9.6.10-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.10-1.el7 +11
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-postgresql96-postgresql-9.6.10-1.el6, rh-postgresql96-postgresql-contrib-9.6.10-1.el6, rh-postgresql96-postgresql-contrib-syspaths-9.6.10-1.el6 +11
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-postgresql96-postgresql-9.6.10-1.el7, rh-postgresql96-postgresql-contrib-9.6.10-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.10-1.el7 +11
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-postgresql96-postgresql-9.6.10-1.el7, rh-postgresql96-postgresql-contrib-9.6.10-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.10-1.el7 +11
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-postgresql96-postgresql-9.6.10-1.el7, rh-postgresql96-postgresql-contrib-9.6.10-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.10-1.el7 +11
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-postgresql96-postgresql-9.6.10-1.el6, rh-postgresql96-postgresql-contrib-9.6.10-1.el6, rh-postgresql96-postgresql-contrib-syspaths-9.6.10-1.el6 +11
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-postgresql96-postgresql-9.6.10-1.el7, rh-postgresql96-postgresql-contrib-9.6.10-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.10-1.el7 +11

Fixes 7 records

TI-2018-00978 CVE-2018-1058 · GHSA-wj3f-f94q-2r98

Improper input validation in postgresql

MEDIUM 53

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.13098 Published 2018-03-02 Partial fix CWE-20

TI-2018-01033 CVE-2018-1115 · GHSA-54w7-jv4g-qhqg

Incorrect permission assignment in postgresql

MEDIUM 52

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.03826 Published 2018-05-10 Partial fix CWE-732

TI-2018-07727 CVE-2018-10915 · GHSA-q7vw-gjh3-qf97

Information disclosure in postgresql

MEDIUM 45

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections.

CVSS 3.0HIGH 8.5 Network Low privileges No interaction EPSS 0.05089 Published 2018-08-09 Partial fix CWE-200

TI-2017-11072 CVE-2017-15098 · GHSA-4r9v-fq66-c5gx

Information disclosure in Red Hat postgresql

MEDIUM 42

Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or dis…

CVSS 3.0HIGH 8.1 Network Low privileges No interaction EPSS 0.03723 Published 2017-11-22 Partial fix CWE-200

TI-2018-07737 CVE-2018-10925 · GHSA-mr45-mwhc-fw72

Incorrect authorization in postgresql

MEDIUM 40

It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ...

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.02241 Published 2018-08-09 Partial fix CWE-863

TI-2017-11073 CVE-2017-15099 · GHSA-pcph-v7q2-77cx

Information disclosure in Red Hat postgresql

LOW 38

INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.06324 Published 2017-11-22 Fixed CWE-200

TI-2018-00974 CVE-2018-1053 · GHSA-h73g-3m4r-j2cr

Incorrect permission assignment in postgresql

LOW 31

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under um…

CVSS 3.0HIGH 7.0 Local Low privileges No interaction EPSS 0.00482 Published 2018-02-09 Partial fix · 9.3.21, 9.4.16 +3 CWE-377