GLSA
Advocate
Joined: 12 May 2004
Posts: 2663
|
 Posted: Sun Dec 02, 2018 5:26 pm Post subject: [ GLSA 201811-24 ] PostgreSQL |
 |
|
Gentoo Linux Security Advisory
Title: PostgreSQL: SQL injection (GLSA 201811-24)
Severity: normal
Exploitable: remote
Date: 2018-11-30
Bug(s): #670724
ID: 201811-24
Synopsis
A SQL injection in PostgreSQL may allow attackers to execute
arbitrary SQL statements.
Background
PostgreSQL is an open source object-relational database management
system.
Affected Packages
Package: dev-db/postgresql
Vulnerable: < 9.3.25
Vulnerable: < 9.4.20
Vulnerable: < 9.5.15
Vulnerable: < 9.6.11
Vulnerable: < 10.6
Vulnerable: < 11.1
Unaffected: >= 9.3.25
Unaffected: >= 9.4.20
Unaffected: >= 9.5.15
Unaffected: >= 9.6.11
Unaffected: >= 10.6
Unaffected: >= 11.1
Architectures: All supported architectures
Description
A vulnerability was discovered in PostgreSQL’s pg_upgrade and pg_dump.
Impact
An attacker, by enticing a user to process a specially crafted trigger
definition, can execute arbitrary SQL statements with superuser
privileges.
Workaround
There is no known workaround at this time.
Resolution
All PostgreSQL 9.3.x users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.3.25"
|
All PostgreSQL 9.4.x users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.4.20"
|
All PostgreSQL 9.5.x users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.5.15"
|
All PostgreSQL 9.6.x users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/postgresql-9.6.11"
|
All PostgreSQL 10.x users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/postgresql-10.6"
|
All PostgreSQL 11.x users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/postgresql-11.1"
|
References
CVE-2018-16850
Last edited by GLSA on Tue Dec 04, 2018 4:17 am; edited 1 time in total |
|
News & Announcements
