RedHatRHSA-2017:2860(RHSA-2017:2860) Moderate: postgresql security update
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.28 Low
EPSS
Percentile
96.8%
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
- It was found that authenticating to a PostgreSQL database account with an empty password was possible despite libpq’s refusal to send an empty password. A remote attacker could potentially use this flaw to gain access to database accounts with empty passwords. (CVE-2017-7546)
Red Hat would like to thank the PostgreSQL project for reporting this issue. Upstream acknowledges Ben de Graaff, Jelte Fennema, and Jeroen van der Ham as the original reporters.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| RedHat | 6 | s390x | postgresql-devel | < 8.4.20-8.el6_9 | postgresql-devel-8.4.20-8.el6_9.s390x.rpm |
| RedHat | 6 | ppc64 | postgresql-libs | < 8.4.20-8.el6_9 | postgresql-libs-8.4.20-8.el6_9.ppc64.rpm |
| RedHat | 6 | s390x | postgresql-docs | < 8.4.20-8.el6_9 | postgresql-docs-8.4.20-8.el6_9.s390x.rpm |
| RedHat | 6 | i686 | postgresql-debuginfo | < 8.4.20-8.el6_9 | postgresql-debuginfo-8.4.20-8.el6_9.i686.rpm |
| RedHat | 6 | s390 | postgresql-debuginfo | < 8.4.20-8.el6_9 | postgresql-debuginfo-8.4.20-8.el6_9.s390.rpm |
| RedHat | 6 | ppc64 | postgresql-server | < 8.4.20-8.el6_9 | postgresql-server-8.4.20-8.el6_9.ppc64.rpm |
| RedHat | 6 | s390x | postgresql-contrib | < 8.4.20-8.el6_9 | postgresql-contrib-8.4.20-8.el6_9.s390x.rpm |
| RedHat | 6 | x86_64 | postgresql-plperl | < 8.4.20-8.el6_9 | postgresql-plperl-8.4.20-8.el6_9.x86_64.rpm |
| RedHat | 6 | x86_64 | postgresql-libs | < 8.4.20-8.el6_9 | postgresql-libs-8.4.20-8.el6_9.x86_64.rpm |
| RedHat | 6 | x86_64 | postgresql-plpython | < 8.4.20-8.el6_9 | postgresql-plpython-8.4.20-8.el6_9.x86_64.rpm |
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.28 Low
EPSS
Percentile
96.8%