Stay Secure with the Latest Linux Advisories

security advisorydata leakuser privilege

Scientific Linux: SLSA-2017:1983-1 Moderate: PostgreSQL Data Access Risks

It was found that some selectivity estimation functions did not check user privileges before providing information from pg_statistic, possibly leaking information. A non-administrative database user could use this flaw to steal some information from tables they are otherwise not allowed to access. (CVE-2017-7484) * It was found that the pg_user_mappings view could disclose information about u [More...]. Synopsis: Moderate: postgresql security and enhancement update Advisory ID: SLSA-2017:1983-1 Issue Date: 2017-08-01 CVE Numbers: CVE-2017-7484 CVE-2017-7486 -- The following packages have been upgraded to a later upstream version: postgresql (9.2.21). Security Fix(es): * It was found that some selectivity estimation functions did not check user privileges before providing information from pg_statistic, possibly leaking information. A non-administrative database user could use this flaw to steal some information from tables they are otherwise not allowed to access. (CVE-2017-7484) * It was found that the pg_user_mappings view could disclose information about user mappings to a foreign database to non-administrative database users. A database user with USAGE privilege for this mapping could, when querying the view, obtain user mapping data, such as the username and password used to connect to the foreign database. (CVE-2017-7486) -- SL7 x86_64 postgresql-debuginfo-9.2.21-1.el7.i686.rpm postgresql-debuginfo-9.2.21-1.el7.x86_64.rpm postgresql-libs-9.2.21-1.el7.i686.rpm postgresql-libs-9.2.21-1.el7.x86_64.rpm postgresql-9.2.21-1.el7.i686.rpm postgresql-9.2.21-1.el7.x86_64.rpm postgresql-contrib-9.2.21-1.el7.x86_64.rpm postgresql-devel-9.2.21-1.el7.i686.rpm postgresql-devel-9.2.21-1.el7.x86_64.rpm postgresql-docs-9.2.21-1.el7.x86_64.rpm postgresql-plperl-9.2.21-1.el7.x86_64.rpm postgresql-plpython-9.2.21-1.el7.x86_64.rpm postgresql-pltcl-9.2.21-1.el7.x86_64.rpm postgresql-server-9.2.21-1.el7.x86_64.rpm postgresql-static-9.2.21-1.el7.i686.rpm postgresql-static-9.2.21-1.el7.x86_64.rpm postgresql-test-9.2.21-1.el7.x86_64.rpm postgresql-upgrade-9.2.21-1.el7.x86_64.rpm - Scientific Linux Development Team . Scheduled PostgreSQL upgrade on Scientific Linux to address security vulnerabilities related to memory leaks and enhance data access management. Advisory ID: SLSA-2017:1983-1.. postgresql security, scientific linux update, data leak issues, user privilege management. . LinuxSecurity.com Team

Aug 21, 2017 Scientific Linux