Issued:

2017-12-08

Updated:

2017-12-08

RHSA-2017:3404 - Moderate: rh-postgresql95-postgresql security update

Synopsis

Moderate: rh-postgresql95-postgresql security update

Type/Severity

Security Advisory Moderate

Topic

An update for rh-postgresql95-postgresql is now available for Red Hat Software Collections.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

• Privilege escalation flaws were found in the initialization scripts of PostgreSQL. An attacker with access to the postgres user account could use these flaws to obtain root access on the server machine. (CVE-2017-12172, CVE-2017-15097)

Note: This patch drops the script privileges from root to the postgres user. Therefore, we dropped the --new-systemd-unit option for security reasons. Please use the root-only script postgresql-new-systemd-unit.

Red Hat would like to thank the PostgreSQL project for reporting CVE-2017-12172. The CVE-2017-15097 issue was discovered by Pedro Barbosa (Red Hat) and the PostgreSQL project. Upstream acknowledges Antoine Scemama (Brainloop) as the original reporter of these issues.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update.

Affected Products

Updated Packages

• rh-postgresql95-postgresql-docs-9.5.9-4.el6.x86_64.rpm
• rh-postgresql95-postgresql-plperl-9.5.9-4.el6.x86_64.rpm
• rh-postgresql95-postgresql-plpython-9.5.9-4.el7.x86_64.rpm
• rh-postgresql95-postgresql-pltcl-9.5.9-4.el7.x86_64.rpm
• rh-postgresql95-postgresql-test-9.5.9-4.el7.x86_64.rpm
• rh-postgresql95-postgresql-static-9.5.9-4.el7.x86_64.rpm
• rh-postgresql95-postgresql-pltcl-9.5.9-4.el6.x86_64.rpm
• rh-postgresql95-postgresql-libs-9.5.9-4.el6.x86_64.rpm
• rh-postgresql95-postgresql-libs-9.5.9-4.el7.x86_64.rpm
• rh-postgresql95-postgresql-9.5.9-4.el7.x86_64.rpm
• rh-postgresql95-postgresql-contrib-9.5.9-4.el6.x86_64.rpm
• rh-postgresql95-postgresql-contrib-9.5.9-4.el7.x86_64.rpm
• rh-postgresql95-postgresql-static-9.5.9-4.el6.x86_64.rpm
• rh-postgresql95-postgresql-devel-9.5.9-4.el6.x86_64.rpm
• rh-postgresql95-postgresql-plperl-9.5.9-4.el7.x86_64.rpm
• rh-postgresql95-postgresql-debuginfo-9.5.9-4.el7.x86_64.rpm
• rh-postgresql95-postgresql-9.5.9-4.el6.x86_64.rpm
• rh-postgresql95-postgresql-docs-9.5.9-4.el7.x86_64.rpm
• rh-postgresql95-postgresql-test-9.5.9-4.el6.x86_64.rpm
• rh-postgresql95-postgresql-9.5.9-4.el6.src.rpm
• rh-postgresql95-postgresql-server-9.5.9-4.el6.x86_64.rpm
• rh-postgresql95-postgresql-server-9.5.9-4.el7.x86_64.rpm
• rh-postgresql95-postgresql-plpython-9.5.9-4.el6.x86_64.rpm
• rh-postgresql95-postgresql-9.5.9-4.el7.src.rpm
• rh-postgresql95-postgresql-debuginfo-9.5.9-4.el6.x86_64.rpm
• rh-postgresql95-postgresql-devel-9.5.9-4.el7.x86_64.rpm

Fixes

• This content is not included.BZ - 1498394
• This content is not included.BZ - 1508985

CVEs

• CVE-2017-12172
• CVE-2017-15097

References

• https://access.redhat.com/security/updates/classification/#moderate

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.