Postgresql93 was updated to 9.3.18 to fix the following issues :

  - CVE-2017-7547: Further restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1051685)

  - CVE-2017-7546: Disallow empty passwords in all     password-based authentication methods. (bsc#1051684)

  - CVE-2017-7548: lo_put() function ignores ACLs.
    (bsc#1053259)

The changelog for the release is here :

&#9;https://www.postgresql.org/docs/9.3/static/release-9-3-18.html

This update was imported from the SUSE:SLE-12:Update update project.

pg_user_mappings view discloses passwords to users lacking server privileges :

An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on foreign servers. A remote authenticated attacker could potentially use this flaw to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so. (CVE-2017-7547)

Empty password accepted in some authentication methods :

It was found that authenticating to a PostgreSQL database account with an empty password was possible despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to gain access to database accounts with empty passwords. (CVE-2017-7546)

lo_put() function ignores ACLs :

An authorization flaw was found in the way PostgreSQL handled large objects. A remote authenticated attacker with no privileges on a large object could potentially use this flaw to overwrite the entire content of the object, thus resulting in denial of service. (CVE-2017-7548)

This update for postgresql94 fixes the following issues :

  - CVE-2017-7547: Further restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1051685)

  - CVE-2017-7546: Disallow empty passwords in all     password-based authentication methods. (bsc#1051684)

  - CVE-2017-7548: lo_put() function ignores ACLs.
    (bsc#1053259)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql95 fixes the following issues :

Upate to PostgreSQL 9.5.11 :

Security issues fixed :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-11.html 

  - CVE-2018-1053, boo#1077983: Ensure that all temporary     files made by pg_upgrade are non-world-readable. 

  - boo#1079757: Rename pg_rewind's copy_file_range function     to avoid conflict with new Linux system call of that     name.

In version 9.5.10 :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-10.html

  - CVE-2017-15098, boo#1067844: Memory disclosure in JSON     functions.

  - CVE-2017-15099, boo#1067841: INSERT ... ON CONFLICT DO     UPDATE fails to enforce SELECT privileges.

In version 9.5.9 :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-9.html

  - Show foreign tables in     information_schema.table_privileges view.

  - Clean up handling of a fatal exit (e.g., due to receipt     of SIGTERM) that occurs while trying to execute a     ROLLBACK of a failed transaction.

  - Remove assertion that could trigger during a fatal exit.

  - Correctly identify columns that are of a range type or     domain type over a composite type or domain type being     searched for.

  - Fix crash in pg_restore when using parallel mode and     using a list file to select a subset of items to     restore.

  - Change ecpg's parser to allow RETURNING clauses without     attached C variables.

In version 9.5.8

  - https://www.postgresql.org/docs/9.5/static/release-9-5-8.html

  - CVE-2017-7547, boo#1051685: Further restrict visibility     of pg_user_mappings.umoptions, to protect passwords     stored as user mapping options.

  - CVE-2017-7546, boo#1051684: Disallow empty passwords in     all password-based authentication methods.

  - CVE-2017-7548, boo#1053259: lo_put() function ignores     ACLs.

ID	名稱	產品	系列	已發布	已更新	嚴重性
102847	openSUSE Security Update : postgresql93 (openSUSE-2017-985)	Nessus	SuSE Local Security Checks	2017/8/31	2021/1/19	critical
102873	Amazon Linux AMI : postgresql94 / postgresql95 (ALAS-2017-885)	Nessus	Amazon Linux Local Security Checks	2017/9/1	2018/4/18	critical
102973	SUSE SLED12 / SLES12 Security Update : postgresql94 (SUSE-SU-2017:2355-1)	Nessus	SuSE Local Security Checks	2017/9/6	2021/1/6	critical
106965	openSUSE Security Update : postgresql95 (openSUSE-2018-204)	Nessus	SuSE Local Security Checks	2018/2/23	2021/1/19	critical

偵測

搜尋 Plugin

critical

critical

critical

critical