-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: rh-postgresql95-postgresql security update Advisory ID: RHSA-2018:2511-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2018:2511 Issue date: 2018-08-20 CVE Names: CVE-2017-15098 CVE-2017-15099 CVE-2018-1053 CVE-2018-1058 CVE-2018-10915 CVE-2018-10925 ===================================================================== 1. Summary: An update for rh-postgresql95-postgresql is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: PostgreSQL is an advanced object-relational database management system (DBMS). The following packages have been upgraded to a later upstream version: rh-postgresql95-postgresql (9.5.14). (BZ#1612671) Security Fix(es): * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915) * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements (CVE-2018-10925) * postgresql: Memory disclosure in JSON functions (CVE-2017-15098) * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053) * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058) * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915, CVE-2018-10925, CVE-2017-15098, CVE-2018-1053, and CVE-2017-15099. Upstream acknowledges Andrew Krasichkov as the original reporter of CVE-2018-10915; David Rowley as the original reporter of CVE-2017-15098; Tom Lane as the original reporter of CVE-2018-1053; and Dean Rasheed as the original reporter of CVE-2017-15099. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 If the postgresql service is running, it will be automatically restarted after installing this update. 5. Bugs fixed (https://bugzilla.redhat.com/): 1508820 - CVE-2017-15098 postgresql: Memory disclosure in JSON functions 1508823 - CVE-2017-15099 postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges 1539619 - CVE-2018-1053 postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask 1547044 - CVE-2018-1058 postgresql: Uncontrolled search path element in pg_dump and other client applications 1609891 - CVE-2018-10915 postgresql: Certain host connection parameters defeat client-side security defenses 1612619 - CVE-2018-10925 postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: rh-postgresql95-postgresql-9.5.14-1.el6.src.rpm x86_64: rh-postgresql95-postgresql-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-contrib-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-debuginfo-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-devel-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-docs-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-libs-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-plperl-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-plpython-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-pltcl-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-server-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-static-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-test-9.5.14-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: rh-postgresql95-postgresql-9.5.14-1.el6.src.rpm x86_64: rh-postgresql95-postgresql-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-contrib-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-debuginfo-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-devel-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-docs-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-libs-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-plperl-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-plpython-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-pltcl-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-server-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-static-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-test-9.5.14-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: rh-postgresql95-postgresql-9.5.14-1.el6.src.rpm x86_64: rh-postgresql95-postgresql-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-contrib-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-debuginfo-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-devel-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-docs-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-libs-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-plperl-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-plpython-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-pltcl-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-server-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-static-9.5.14-1.el6.x86_64.rpm rh-postgresql95-postgresql-test-9.5.14-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-postgresql95-postgresql-9.5.14-1.el7.src.rpm x86_64: rh-postgresql95-postgresql-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-contrib-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-debuginfo-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-devel-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-docs-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-libs-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-plperl-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-plpython-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-pltcl-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-server-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-static-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-test-9.5.14-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3): Source: rh-postgresql95-postgresql-9.5.14-1.el7.src.rpm x86_64: rh-postgresql95-postgresql-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-contrib-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-debuginfo-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-devel-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-docs-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-libs-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-plperl-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-plpython-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-pltcl-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-server-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-static-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-test-9.5.14-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4): Source: rh-postgresql95-postgresql-9.5.14-1.el7.src.rpm x86_64: rh-postgresql95-postgresql-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-contrib-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-debuginfo-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-devel-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-docs-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-libs-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-plperl-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-plpython-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-pltcl-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-server-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-static-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-test-9.5.14-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5): Source: rh-postgresql95-postgresql-9.5.14-1.el7.src.rpm x86_64: rh-postgresql95-postgresql-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-contrib-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-debuginfo-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-devel-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-docs-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-libs-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-plperl-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-plpython-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-pltcl-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-server-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-static-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-test-9.5.14-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-postgresql95-postgresql-9.5.14-1.el7.src.rpm x86_64: rh-postgresql95-postgresql-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-contrib-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-debuginfo-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-devel-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-docs-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-libs-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-plperl-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-plpython-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-pltcl-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-server-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-static-9.5.14-1.el7.x86_64.rpm rh-postgresql95-postgresql-test-9.5.14-1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-15098 https://access.redhat.com/security/cve/CVE-2017-15099 https://access.redhat.com/security/cve/CVE-2018-1053 https://access.redhat.com/security/cve/CVE-2018-1058 https://access.redhat.com/security/cve/CVE-2018-10915 https://access.redhat.com/security/cve/CVE-2018-10925 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBW3qdHtzjgjWX9erEAQjysQ//UsBhEI9KYfAKKnfVIhEIIRm58aboLJZD a8ez2sP872TXzpnILlyFIPLOAs+egVm7+tFNuJi1KHX9ss6Jf/2Yd4LW1/hv3NHv YUyyZZZkwRa03wIy6mcq+lQ/dq/lXNWq7rcC/8qvQ7nyB3q/VknreLsWknDYBsYf XbhqBz1A3lMBrL1knJQPH34eAkk8vUlWqZXWQrrXecOivk+3/w0HkKtvzF9ksePt Khdl7oA6EvU7zeGIXb5lipCNLrCag0/zcR9wnARlmOFlWhN0fhQBZx+eWxxXpQC3 sNg+lccyaL67ZtqCn1czYOktNQAa+YkTm5Pld5gTo5c41I6qH5Nc685iQX9GXTCM RhfFQHsH2lbRwmMMTl99eGjFBmcJMXBn86B2sY4NgDnELKzpK6HCkFbo5dgE6cLv fHdId0b5DdiPek269+YZJuLZ6RKvlxxZdaRyy7SegXA2uCrWZO8K1omkOrxk8Fy3 KBwURte8WeURnkMlMuF+rrVyksTDux5JI2dXAYimiqA2ivncVLa8XAafZwBOo2/E nkfnqqZs8JwS38o70iB3luJ5H19ab3u9juyauH4CX+hAATQGsgv5T226eonJYhAn 2rLs6Idd0Y9eDUIt2bJwOd/+ZcPF1nRHoaVuiOqUfSdFDqaAvIPCRl6lYRfGvk1G zTnNBYZkwp8= =XDfq -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce