Important: postgresql95, postgresql96

Issue Overview:

A flaw was found in postgresql. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25694)

A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)

A flaw was found in the psql interactive terminal of PostgreSQL. If an interactive psql session uses \gset when querying a compromised server, this flaw allows an attacker to execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-25696)

Affected Packages:

postgresql95, postgresql96

Issue Correction:
Run yum update postgresql95 to update your system.
Run yum update postgresql96 to update your system.

New Packages:

i686:  
    postgresql95-contrib-9.5.24-1.82.amzn1.i686  
    postgresql95-plperl-9.5.24-1.82.amzn1.i686  
    postgresql95-test-9.5.24-1.82.amzn1.i686  
    postgresql95-docs-9.5.24-1.82.amzn1.i686  
    postgresql95-libs-9.5.24-1.82.amzn1.i686  
    postgresql95-plpython26-9.5.24-1.82.amzn1.i686  
    postgresql95-static-9.5.24-1.82.amzn1.i686  
    postgresql95-devel-9.5.24-1.82.amzn1.i686  
    postgresql95-debuginfo-9.5.24-1.82.amzn1.i686  
    postgresql95-plpython27-9.5.24-1.82.amzn1.i686  
    postgresql95-server-9.5.24-1.82.amzn1.i686  
    postgresql95-9.5.24-1.82.amzn1.i686  
    postgresql96-test-9.6.20-1.84.amzn1.i686  
    postgresql96-plpython27-9.6.20-1.84.amzn1.i686  
    postgresql96-server-9.6.20-1.84.amzn1.i686  
    postgresql96-debuginfo-9.6.20-1.84.amzn1.i686  
    postgresql96-devel-9.6.20-1.84.amzn1.i686  
    postgresql96-plpython26-9.6.20-1.84.amzn1.i686  
    postgresql96-contrib-9.6.20-1.84.amzn1.i686  
    postgresql96-libs-9.6.20-1.84.amzn1.i686  
    postgresql96-plperl-9.6.20-1.84.amzn1.i686  
    postgresql96-static-9.6.20-1.84.amzn1.i686  
    postgresql96-9.6.20-1.84.amzn1.i686  
    postgresql96-docs-9.6.20-1.84.amzn1.i686  
  
src:  
    postgresql95-9.5.24-1.82.amzn1.src  
    postgresql96-9.6.20-1.84.amzn1.src  
  
x86_64:  
    postgresql95-test-9.5.24-1.82.amzn1.x86_64  
    postgresql95-docs-9.5.24-1.82.amzn1.x86_64  
    postgresql95-devel-9.5.24-1.82.amzn1.x86_64  
    postgresql95-libs-9.5.24-1.82.amzn1.x86_64  
    postgresql95-contrib-9.5.24-1.82.amzn1.x86_64  
    postgresql95-plperl-9.5.24-1.82.amzn1.x86_64  
    postgresql95-debuginfo-9.5.24-1.82.amzn1.x86_64  
    postgresql95-static-9.5.24-1.82.amzn1.x86_64  
    postgresql95-plpython26-9.5.24-1.82.amzn1.x86_64  
    postgresql95-server-9.5.24-1.82.amzn1.x86_64  
    postgresql95-9.5.24-1.82.amzn1.x86_64  
    postgresql95-plpython27-9.5.24-1.82.amzn1.x86_64  
    postgresql96-static-9.6.20-1.84.amzn1.x86_64  
    postgresql96-debuginfo-9.6.20-1.84.amzn1.x86_64  
    postgresql96-server-9.6.20-1.84.amzn1.x86_64  
    postgresql96-plpython26-9.6.20-1.84.amzn1.x86_64  
    postgresql96-test-9.6.20-1.84.amzn1.x86_64  
    postgresql96-contrib-9.6.20-1.84.amzn1.x86_64  
    postgresql96-devel-9.6.20-1.84.amzn1.x86_64  
    postgresql96-docs-9.6.20-1.84.amzn1.x86_64  
    postgresql96-plperl-9.6.20-1.84.amzn1.x86_64  
    postgresql96-9.6.20-1.84.amzn1.x86_64  
    postgresql96-libs-9.6.20-1.84.amzn1.x86_64  
    postgresql96-plpython27-9.6.20-1.84.amzn1.x86_64  

Additional References

Red Hat: CVE-2020-25694, CVE-2020-25695, CVE-2020-25696

Mitre: CVE-2020-25694, CVE-2020-25695, CVE-2020-25696