Rewterz Threat Advisory – Red Hat Update for postgresql

Red Hat has issued an update for postgresql. This fixes a vulnerability in which certain host connection parameters defeat client-side security defenses

IMPACT:  CRITICAL

PUBLISH DATE: 24-08-2018

OVERVIEW

Libpq, the default PostgreSQL client library, was found to be vulnerable as libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with “host” or “hostaddr” connection parameters from untrusted input, attackers could bypass client-side connection security features, which enables them to acquire access to higher privileged connections or potentially cause other impacts through SQL injection, by causing the PQescape() functions to malfunction.

ANALYSIS:

An attacker can only exploit this vulnerability by providing or influencing connection parameters to a PostgreSQL client application using libpq. Contrib modules “dblink” and “postgres_fdw” are examples of applications affected by this flaw.Red Hat Virtualization includes vulnerable versions of postgresql.

However, this flaw is not known to be exploitable under any supported configuration of Red Hat Virtualization. A future update may address this issue.Red Hat has issued updates for fixing the said vulnerability.

AFFECTED PRODUCTS

Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected in:

• Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.5 x86_64
• Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.4 x86_64
• Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.3 x86_64
• Red Hat Software Collections (for RHEL Server) 1 for RHEL 7 x86_64
• Red Hat Software Collections (for RHEL Server) 1 for RHEL 6.7 x86_64
• Red Hat Software Collections (for RHEL Server) 1 for RHEL 6 x86_64
• Red Hat Software Collections (for RHEL Workstation) 1 for RHEL 7 x86_64
• Red Hat Software Collections (for RHEL Workstation) 1 for RHEL 6 x86_64
• Red Hat Virtualization Manager 4.2 x86_64

UPDATES

• BZ – 1508820 – CVE-2017-15098 postgresql: Memory disclosure in JSON functions
• BZ – 1508823 – CVE-2017-15099 postgresql: INSERT … ON CONFLICT DO UPDATE fails to enforce SELECT privileges
• BZ – 1539619 – CVE-2018-1053 postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask
• BZ – 1547044 – CVE-2018-1058 postgresql: Uncontrolled search path element in pg_dump and other client applications
• BZ – 1609891 – CVE-2018-10915 postgresql: Certain host connection parameters defeat client-side security defenses
• BZ – 1612619 – CVE-2018-10925 postgresql: Missing authorization and memory disclosure in INSERT … ON CONFLICT DO UPDATE statements

Follow the link for further guidance on how to apply updates:

https://access.redhat.com/articles/11258