Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.1865
Moderate: rh-postgresql95-postgresql security update
1 August 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: rh-postgresql95-postgresql
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Provide Misleading Information -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2017-7486 CVE-2017-7485 CVE-2017-7484
Reference: ESB-2017.1690
ESB-2017.1216
Original Bulletin:
https://access.redhat.com/errata/RHSA-2017:1838
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: rh-postgresql95-postgresql security update
Advisory ID: RHSA-2017:1838-01
Product: Red Hat Satellite
Advisory URL: https://access.redhat.com/errata/RHSA-2017:1838
Issue date: 2017-07-31
CVE Names: CVE-2017-7484 CVE-2017-7485 CVE-2017-7486
=====================================================================
1. Summary:
An update for rh-postgresql95-postgresql is now available for Red Hat
Satellite 5.8 and Red Hat Satellite 5.8 ELS.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
This update applies only to Satellite 5.8 instances using either embedded
or managed PostgreSQL databases.
There are manual steps required in order to finish the migration from
postgresql92-postgresql to rh-postgresql95-postgresql. If these steps are
not undertaken, the affected Satellite will continue to use PostgreSQL 9.2.
postgresql92-postgresql will be upgraded automatically to
rh-postgresql95-postgresql as part of an upgrade to Satellite 5.8.
2. Relevant releases/architectures:
Red Hat Satellite 5.8 (RHEL v.6) - s390x, x86_64
Red Hat Satellite 5.8 ELS (RHEL v.6) - s390x, x86_64
Red Hat Satellite Managed DB 5.8 (RHEL v.6) - s390x, x86_64
Red Hat Satellite Managed DB 5.8 ELS (RHEL v.6) - s390x, x86_64
3. Description:
PostgreSQL is an advanced object-relational database management system
(DBMS).
Security Fix(es):
* It was found that some selectivity estimation functions did not check
user privileges before providing information from pg_statistic, possibly
leaking information. A non-administrative database user could use this flaw
to steal some information from tables they are otherwise not allowed to
access. (CVE-2017-7484)
* It was discovered that the PostgreSQL client library (libpq) did not
enforce the use of TLS/SSL for a connection to a PostgreSQL server when the
PGREQUIRESSL environment variable was set. An man-in-the-middle attacker
could use this flaw to strip the SSL/TLS protection from a connection
between a client and a server. (CVE-2017-7485)
* It was found that the pg_user_mappings view could disclose information
about user mappings to a foreign database to non-administrative database
users. A database user with USAGE privilege for this mapping could, when
querying the view, obtain user mapping data, such as the username and
password used to connect to the foreign database. (CVE-2017-7486)
Red Hat would like to thank the PostgreSQL project for reporting these
issues. Upstream acknowledges Robert Haas as the original reporter of
CVE-2017-7484; Daniel Gustafsson as the original reporter of CVE-2017-7485;
and Andrew Wheelwright as the original reporter of CVE-2017-7486.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After applying this update restart Satellite database using following
command:
db-control stop && db-control start
5. Bugs fixed (https://bugzilla.redhat.com/):
1448078 - CVE-2017-7484 postgresql: Selectivity estimators bypass SELECT privilege checks
1448086 - CVE-2017-7485 postgresql: libpq ignores PGREQUIRESSL environment variable
1448089 - CVE-2017-7486 postgresql: pg_user_mappings view discloses foreign server passwords
6. Package List:
Red Hat Satellite Managed DB 5.8 (RHEL v.6):
Source:
rh-postgresql95-postgresql-9.5.7-2.el6.src.rpm
s390x:
rh-postgresql95-postgresql-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-contrib-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-debuginfo-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-libs-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-pltcl-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-server-9.5.7-2.el6.s390x.rpm
x86_64:
rh-postgresql95-postgresql-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-contrib-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-debuginfo-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-libs-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-pltcl-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-server-9.5.7-2.el6.x86_64.rpm
Red Hat Satellite Managed DB 5.8 ELS (RHEL v.6):
Source:
rh-postgresql95-postgresql-9.5.7-2.el6.src.rpm
s390x:
rh-postgresql95-postgresql-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-contrib-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-debuginfo-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-libs-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-pltcl-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-server-9.5.7-2.el6.s390x.rpm
x86_64:
rh-postgresql95-postgresql-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-contrib-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-debuginfo-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-libs-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-pltcl-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-server-9.5.7-2.el6.x86_64.rpm
Red Hat Satellite 5.8 (RHEL v.6):
Source:
rh-postgresql95-postgresql-9.5.7-2.el6.src.rpm
s390x:
rh-postgresql95-postgresql-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-contrib-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-debuginfo-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-libs-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-pltcl-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-server-9.5.7-2.el6.s390x.rpm
x86_64:
rh-postgresql95-postgresql-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-contrib-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-debuginfo-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-libs-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-pltcl-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-server-9.5.7-2.el6.x86_64.rpm
Red Hat Satellite 5.8 ELS (RHEL v.6):
Source:
rh-postgresql95-postgresql-9.5.7-2.el6.src.rpm
s390x:
rh-postgresql95-postgresql-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-contrib-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-debuginfo-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-libs-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-pltcl-9.5.7-2.el6.s390x.rpm
rh-postgresql95-postgresql-server-9.5.7-2.el6.s390x.rpm
x86_64:
rh-postgresql95-postgresql-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-contrib-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-debuginfo-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-libs-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-pltcl-9.5.7-2.el6.x86_64.rpm
rh-postgresql95-postgresql-server-9.5.7-2.el6.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2017-7484
https://access.redhat.com/security/cve/CVE-2017-7485
https://access.redhat.com/security/cve/CVE-2017-7486
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2017 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFZf1e3XlSAg2UNWIIRAvvkAJ9KDupswkYrHXgeklu1TAuaWpbYCACfYBGr
QnYFxeStN7Y3nUC4KbPhdO4=
=epP+
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWX/Dn4x+lLeg9Ub1AQj+Eg//bM7KBGXhjlP+JNYBxx9n56fdp20k6BHM
FGqpL/Uz9thwqZC3m86NXqFByVRM36wlR9UWUC8wMDtMDevFUcP1m1DGVnXhi9k7
GCfobwUNibRTM9sF8aKrLNjGBUQ0jVEAeQB2u+sWnHImyTil7A1s/iiHLG1k5LLd
pzmgCFZNZu/8TISNXpLMy90eEe/34rv8NTShHAWldaT3AtruyNJYeFARCqa1oVSm
P5Za9LQON9X1XC4w5i61IME/m/YoIakryzjh+TYHZyoy9yCvT+MGMo/I7Yf+QP6B
moUMlftOPeQO20hnKtpwObsjzIjcM0AFCq4AmH12DtTXG66nrFE6z3y6yKpEyrhH
6BcDuauAxMZxEoiDmRvr7gl1HGddORADcRlsPRUtxbhlJ9WFl34eXGXbT45SniSr
Bs1X9wrv1TVTEIvIvLQIu0e6TwkFWPQjZ+7ly6J5/Cn8pVqPx77k/ewpJGv65oq4
wChev+PUyrpEFTFtPFRkzWBqOnhCT8eWqucAULnPPMGO/0ikH/2snEpzRE2qgjmd
eP+myVYJiGLc+ilZYSFX8Tgkt7HT5mCPc7Lc/x6dv/wTcMCuTqI+1WJyNBWW9cO6
ri1LuSqwMX1Yd3YO9WZSReFPX3WNpUtDG+RCoD2mpnk6fJg8abKCEchhHnYU4sYI
ybRla7Sorp8=
=gQHO
-----END PGP SIGNATURE-----