Описание
Security update for postgresql93
Postgresql93 was updated to 9.3.18 to fix the following issues:
- CVE-2017-7547: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1051685)
- CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. (bsc#1051684)
- CVE-2017-7548: lo_put() function ignores ACLs. (bsc#1053259)
The changelog for the release is here:
Список пакетов
SUSE Linux Enterprise Server 12-LTSS
SUSE Linux Enterprise Server for SAP Applications 12
Ссылки
- Link for SUSE-SU-2017:2236-1
- E-Mail link for SUSE-SU-2017:2236-1
- SUSE Security Ratings
- SUSE Bug 1051684
- SUSE Bug 1051685
- SUSE Bug 1053259
- SUSE CVE CVE-2017-7546 page
- SUSE CVE CVE-2017-7547 page
- SUSE CVE CVE-2017-7548 page
Описание
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.
Затронутые продукты
Ссылки
- CVE-2017-7546
- SUSE Bug 1051684
- SUSE Bug 1054365
- SUSE Bug 1140876
Описание
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so.
Затронутые продукты
Ссылки
- CVE-2017-7547
- SUSE Bug 1051685
- SUSE Bug 1054365
- SUSE Bug 1140876
Описание
PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.
Затронутые продукты
Ссылки
- CVE-2017-7548
- SUSE Bug 1053259
- SUSE Bug 1054365
- SUSE Bug 1140876