[SECURITY] Fedora 32 Update: roundcubemail-1.4.10-1.fc32

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

The vulnerability of the PostgreSQL database management system, related to an unreliable search path, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the PostgreSQL database management system is related to an unreliable search path mechanism. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and even cause service failures...

The vulnerability of the “ALTER ... DEPENDS ON EXTENSION” component in the PostgreSQL database management system allows a attacker to compromise data integrity.

The vulnerability of the “ALTER ... DEPENDS ON EXTENSION” component in the PostgreSQL database management system is related to the absence of an authentication mechanism. Exploiting this vulnerability could allow a perpetrator to compromise the integrity of the data...

Security Bulletin: PostgreSQL Vulnerability Affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2020-25696)

Summary There is a vulnerability in PostgreSQL 9.5 and 11 used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2020-25696 DESCRIPTION: PostgreSQL could allow a remote attacke...

postgresql: psql's \gset allows overwriting specially treated variables

A flaw was found in the psql interactive terminal of PostgreSQL. If an interactive psql session uses \gset when querying a compromised server, this flaw allows an attacker to execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to...

postgresql: Reconnection can downgrade connection security settings

A flaw was found in postgresql. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could...

Important: Red Hat Security Advisory: libpq security update

An update for libpq is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

RHEL 8 : libpq (RHSA-2021:0057)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0057 advisory. The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. The following...

Code Injection in spotify/postgresql-metrics

Description Tool that extracts and provides metrics on your PostgreSQL database Vulnerability discription unsafe loading of data by the yaml.load function leading to Arbitrary code execution. Proof of Concept Vulnerable code part python readconfigdict = yaml.loadf...

RHEL 8 : libpq (RHSA-2020:5638)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5638 advisory. The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. The following...

Oracle Linux 8 : ELSA-2020-5619-1: / postgresql:9.6 (ELSA-2020-56191)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-56191 advisory. 9.6.20-1 - Rebase to upstream release 9.6.20 Resolves: rhbz1901563 Resolves: rhbz1898218 Resolves: rhbz1898334 9.6.19-1 - Rebase to 9.6.19 Also fixes:...

postgresql:9.6 security update

9.6.20-1 - Rebase to upstream release 9.6.20 Resolves: rhbz1901563 Resolves: rhbz1898218 Resolves: rhbz1898334 9.6.19-1 - Rebase to 9.6.19 Also fixes: CVE-2019-10208, CVE-2020-14350, CVE-2019-10130 Resolves: 1741490 Resolves: 1867111 Resolves: 1845074...

postgresql:12 security update

postgresql 12.5-1 - Rebase to upstream release 12.5 Resolves: rhbz1901555 Resolves: rhbz1898223 Resolves: rhbz1898329 12.1-3 - Release bump for 8.2.0 BZ1776805 12.1-2 - Release bump for rebuild against libpq-12.1-3 12.1-1 - Rebase to upstream release 12.1 12.0-1 - Rebase to upstream release 12.0...

Oracle Linux 8 : ELSA-2020-5620-1: / postgresql:12 (ELSA-2020-56201)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-56201 advisory. postgresql 12.5-1 - Rebase to upstream release 12.5 Resolves: rhbz1901555 Resolves: rhbz1898223 Resolves: rhbz1898329 12.1-3 - Release bump for 8.2.0...

Oracle Linux 8 : ELSA-2020-5567-1: / postgresql:10 (ELSA-2020-55671)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-55671 advisory. 10.15-1 - Rebase to upstream release 10.15 Resolves: rhbz1898213 Resolves: rhbz1898341 Resolves: rhbz1901567 Tenable has extracted the preceding...

postgresql: Selectivity estimators bypass row security policies

PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit thi...

Important: Red Hat Security Advisory: postgresql:10 security update

An update for the postgresql:10 module is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

postgresql: Reconnection can downgrade connection security settings

A flaw was found in postgresql. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could...

postgresql: Uncontrolled search path element in CREATE EXTENSION

A flaw was found in PostgreSQL, where some PostgreSQL extensions did not use the searchpath safely in their installation script. This flaw allows an attacker with sufficient privileges to trick an administrator into executing a specially crafted script during the extension's installation or updat...

postgresql: Multiple features escape "security restricted operation" sandbox

A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...