Sigurnosni nedostaci programskog paketa rh-postgresql10-postgresql

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: rh-postgresql10-postgresql security update
Advisory ID: RHSA-2018:2565-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2565
Issue date: 2018-08-27
CVE Names: CVE-2018-1115 CVE-2018-10915 CVE-2018-10925
=====================================================================

1. Summary:

An update for rh-postgresql10-postgresql is now available for Red Hat
Software Collections.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) – aarch64, ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) – ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) – ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) – ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) – x86_64

3. Description:

PostgreSQL is an advanced object-relational database management system
(DBMS).

The following packages have been upgraded to a later upstream version:
rh-postgresql10-postgresql (10.5). (BZ#1612673, BZ#1614337)

Security Fix(es):

* postgresql: Certain host connection parameters defeat client-side
security defenses (CVE-2018-10915)

* postgresql: Missing authorization and memory disclosure in INSERT … ON
CONFLICT DO UPDATE statements (CVE-2018-10925)

* postgresql: Too-permissive access control list on function
pg_logfile_rotate() (CVE-2018-1115)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

Red Hat would like to thank the PostgreSQL project for reporting these
issues. Upstream acknowledges Andrew Krasichkov as the original reporter of
CVE-2018-10915; and Stephen Frost as the original reporter of
CVE-2018-1115.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted
after installing this update.

5. Bugs fixed (https://bugzilla.redhat.com/):

1573276 – CVE-2018-1115 postgresql: Too-permissive access control list on function pg_logfile_rotate()
1609891 – CVE-2018-10915 postgresql: Certain host connection parameters defeat client-side security defenses
1612619 – CVE-2018-10925 postgresql: Missing authorization and memory disclosure in INSERT … ON CONFLICT DO UPDATE statements

6. Package List:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):