Red Hat Security Advisory

RHSA-2020:4295

rh-postgresql96-postgresql security update

Released 2020-10-21 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-postgresql96-postgresql-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.19-1.el7 +11
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-postgresql96-postgresql-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.19-1.el7 +11
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-postgresql96-postgresql-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.19-1.el7 +11
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-postgresql96-postgresql-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-9.6.19-1.el7, rh-postgresql96-postgresql-contrib-syspaths-9.6.19-1.el7 +11

Fixes 4 records

TI-2019-07528 CVE-2019-10208 · GHSA-7v5r-hqr9-r2x2

SQL injection in postgresql

MEDIUM 42

A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02188 Published 2019-10-29 Partial fix CWE-89

TI-2020-11221 CVE-2020-14350 · GHSA-6v9v-3f4c-cjgx

Untrusted search path in PostgreSQL

LOW 33

It was found that some PostgreSQL extensions did not use search_path safely in their installation script.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00532 Published 2020-08-24 Partial fix CWE-426

TI-2020-01664 CVE-2020-1720 · GHSA-prcp-93mm-93fm

Improper authorization in Red Hat postgresql

LOW 31

A flaw was found in PostgreSQL's "ALTER ...

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01183 Published 2020-03-17 Fixed CWE-285

TI-2019-07453 CVE-2019-10130 · GHSA-5rxr-v694-cxfj

Improper access control in postgresql

LOW 22

A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01085 Published 2019-07-30 Partial fix CWE-284