This update provides PostgreSQL 8.3.20. As part of this update, the packaging scheme has been changed to accomodate an optional parallel installation of newer PostgreSQL versions.

The changes in 8.3.20 are :

  - Prevent access to external files/URLs via XML entity     references. xml_parse() would attempt to fetch external     files or URLs as needed to resolve DTD and entity     references in an XML value, thus allowing unprivileged     database users to attempt to fetch data with the     privileges of the database server. (CVE-2012-3489,     bnc#776524)

  - Prevent access to external files/URLs via     'contrib/xml2''s xslt_process(). libxslt offers the     ability to read and write both files and URLs through     stylesheet commands, thus allowing unprivileged database     users to both read and write data with the privileges of     the database server. Disable that through proper use of     libxslt's security options. (CVE-2012-3488, bnc#776523).
    Also, remove xslt_process()'s ability to fetch documents     and stylesheets from external files/URLs.

  - Fix incorrect password transformation in     contrib/pgcrypto's DES crypt() function. If a password     string contained the byte value 0x80, the remainder of     the password was ignored, causing the password to be     much weaker than it appeared. With this fix, the rest of     the string is properly included in the DES hash. Any     stored password values that are affected by this bug     will thus no longer match, so the stored values may need     to be updated. (CVE-2012-2143)

  - Ignore SECURITY DEFINER and SET attributes for a     procedural language's call handler. Applying such     attributes to a call handler could crash the server.
    (CVE-2012-2655)

  - Allow numeric timezone offsets in timestamp input to be     up to 16 hours away from UTC. Some historical time zones     have offsets larger than 15 hours, the previous limit.
    This could result in dumped data values being rejected     during reload.

  - Fix timestamp conversion to cope when the given time is     exactly the last DST transition time for the current     timezone. This oversight has been there a long time, but     was not noticed previously because most DST-using zones     are presumed to have an indefinite sequence of future     DST transitions.

  - Fix text to name and char to name casts to perform     string truncation correctly in multibyte encodings.

  - Fix memory copying bug in to_tsquery().

  - Fix slow session startup when pg_attribute is very     large. If pg_attribute exceeds one-fourth of     shared_buffers, cache rebuilding code that is sometimes     needed during session start would trigger the     synchronized-scan logic, causing it to take many times     longer than normal. The problem was particularly acute     if many new sessions were starting at once.

  - Ensure sequential scans check for query cancel     reasonably often. A scan encountering many consecutive     pages that contain no live tuples would not respond to     interrupts meanwhile.

  - Show whole-row variables safely when printing views or     rules. Corner cases involving ambiguous names (that is,     the name could be either a table or column name of the     query) were printed in an ambiguous way, risking that     the view or rule would be interpreted differently after     dump and reload. Avoid the ambiguous case by attaching a     no-op cast.

  - Ensure autovacuum worker processes perform stack depth     checking properly. Previously, infinite recursion in a     function invoked by auto-ANALYZE could crash worker     processes.

  - Fix logging collector to not lose log coherency under     high load. The collector previously could fail to     reassemble large messages if it got too busy.

  - Fix logging collector to ensure it will restart file     rotation after receiving SIGHUP.

  - Fix PL/pgSQL's GET DIAGNOSTICS command when the target     is the function's first variable.

  - Fix several performance problems in pg_dump when the     database contains many objects. pg_dump could get very     slow if the database contained many schemas, or if many     objects are in dependency loops, or if there are many     owned sequences.

  - Fix contrib/dblink's dblink_exec() to not leak temporary     database connections upon error.

- Security and bugfix release 9.1.5 :

  - Ignore SECURITY DEFINER and SET attributes for a     procedural language's call handler (CVE-2012-2655)     bnc#765069

  - Fix incorrect password transformation in     'contrib/pgcrypto''s DES crypt() function     (CVE-2012-2143) bnc#766799

  - Prevent access to external files/URLs via     'contrib/xml2''s xslt_process() (CVE-2012-3488)     bnc#776523

  - Prevent access to external files/URLs via XML entity     references (CVE-2012-3489) bnc#776524

  - See the release notes for the rest of the changes:
    http://www.postgresql.org/docs/9.1/static/release.html     /usr/share/doc/packages/postgresql/HISTORY

The remote Mac OS X 10.8 host has a version of OS X Server installed that is prior to 2.1.1. It is, therefore, affected by the following vulnerabilities :

  - When the xml2 contrib module is enabled in PostgreSQL,     an unprivileged database user can read or write     arbitrary files, subject to the privileges under which     the PostgreSQL server runs, when processing specially-     crafted XSLT documents. (CVE-2012-3488)

  - An unprivileged database user can read arbitrary files,     subject to the privileges under which the PostgreSQL     server runs, because 'xml_parse()' attempts to fetch     external files or URLs as needed to resolve DTD and     entity references in an XML value. (CVE-2012-3489)

  - A malicious XMPP server can spoof domains via a Verify     Response or an Authorization Response because the Jabber     server processes unsolicited XMPP Server Dialback     responses. (CVE-2012-3525)

The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.

This version upgrade of PostgreSQL fixes following issues :

  - Bugfix release 9.0.10 :

  - Fix planner's assignment of executor parameters, and fix     executor's rescan logic for CTE plan nodes.

  - Improve page-splitting decisions in GiST indexes.

  - Fix cascading privilege revoke to stop if privileges are     still held.

  - Improve error messages for Hot Standby misconfiguration     errors.

  - Fix handling of SIGFPE when PL/Perl is in use.

  - Prevent PL/Perl from crashing if a recursive PL/Perl     function is redefined while being executed.

  - Work around possible misoptimization in PL/Perl.

  - See also:
    http://www.postgresql.org/docs/9.0/static/release.html

  - Security and bugfix release 9.0.9 :

  - Prevent access to external files/URLs via contrib/xml2     (CVE-2012-3488, bnc#776523).

  - Prevent access to external files/URLs via XML entity     references (CVE-2012-3489, bnc#776524).

  - Fix incorrect password transformation in     contrib/pgcrypto (CVE-2012-2143, bnc#766799).

  - Ignore SECURITY DEFINER and SET attributes for a     procedural language's call handler (CVE-2012-2655,     bnc#765069).

  - See also:
    http://www.postgresql.org/docs/9.0/static/release.html

  - Rename postgresql-mkspecfiles to pre_checkin.sh

PostgreSQL was updated to the latest stable release 8.1.23, fixing various bugs and security issues.

The following security issues have been fixed :

  - CVE-2012-3488: This update fixes arbitrary read and     write of files via XSL functionality.

  - CVE-2012-2655: postgresql: denial of service (stack     exhaustion) via specially crafted SQL.

  - CVE-2011-2483: crypt_blowfish was mishandling 8 bit     characters.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2012-1005:03 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL     constructs (including transactions, subselects and user-defined types and functions). The postgresql     package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server.
    These PostgreSQL client programs are programs that directly manipulate the internal structure of     PostgreSQL databases on a PostgreSQL server. These client programs can be located on the same machine with     the PostgreSQL server, or may be on a remote machine which accesses a PostgreSQL server over a network     connection. This package contains the docs in HTML for the whole package, as well as command-line     utilities for managing PostgreSQL databases on a PostgreSQL server.
    If you want to manipulate a PostgreSQL database on a local or remote PostgreSQL server, you need this     package. You also need to install this package if you're installing the postgresql-server package.
    Security issues fixed with this release:
     CVE-2012-3488     The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9,     and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote     authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary     external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or     (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to PostgreSQL 9.1.5, for various fixes described at http://www.postgresql.org/docs/9.1/static/release-9-1-5.html including the fixes for CVE-2012-3488, CVE-2012-3489

Configure postmaster to create Unix-domain sockets in both /var/run/postgresql and /tmp; the former is now the default place for libpq to contact the postmaster. This works around problems with clients running in a PrivateTmp context.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been discovered and corrected in postgresql :

Prevent access to external files/URLs via contrib/xml2's xslt_process() (Peter Eisentraut). libxslt offers the ability to read and write both files and URLs through stylesheet commands, thus allowing unprivileged database users to both read and write data with the privileges of the database server. Disable that through proper use of libxslt's security options (CVE-2012-3488). Also, remove xslt_process()'s ability to fetch documents and stylesheets from external files/URLs. While this was a documented feature, it was long regarded as a bad idea. The fix for CVE-2012-3489 broke that capability, and rather than expend effort on trying to fix it, we're just going to summarily remove it.

Prevent access to external files/URLs via XML entity references (Noah Misch, Tom Lane). xml_parse() would attempt to fetch external files or URLs as needed to resolve DTD and entity references in an XML value, thus allowing unprivileged database users to attempt to fetch data with the privileges of the database server. While the external data wouldn't get returned directly to the user, portions of it could be exposed in error messages if the data didn't parse as valid XML; and in any case the mere ability to check existence of a file might be useful to an attacker (CVE-2012-3489).

This advisory provides the latest versions of PostgreSQL that is not vulnerable to these issues.

Updated postgresql84 and postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

It was found that the optional PostgreSQL xml2 contrib module allowed local files and remote URLs to be read and written to with the privileges of the database server when parsing Extensible Stylesheet Language Transformations (XSLT). An unprivileged database user could use this flaw to read and write to local files (such as the database's configuration files) and remote URLs they would otherwise not have access to by issuing a specially crafted SQL query. (CVE-2012-3488)

It was found that the 'xml' data type allowed local files and remote URLs to be read with the privileges of the database server to resolve DTD and entity references in the provided XML. An unprivileged database user could use this flaw to read local files they would otherwise not have access to by issuing a specially crafted SQL query.
Note that the full contents of the files were not returned, but portions could be displayed to the user via error messages.
(CVE-2012-3489)

Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Peter Eisentraut as the original reporter of CVE-2012-3488, and Noah Misch as the original reporter of CVE-2012-3489.

These updated packages upgrade PostgreSQL to version 8.4.13. Refer to the PostgreSQL Release Notes for a list of changes :

http://www.postgresql.org/docs/8.4/static/release-8-4-13.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

Updated postgresql packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

It was found that the optional PostgreSQL xml2 contrib module allowed local files and remote URLs to be read and written to with the privileges of the database server when parsing Extensible Stylesheet Language Transformations (XSLT). An unprivileged database user could use this flaw to read and write to local files (such as the database's configuration files) and remote URLs they would otherwise not have access to by issuing a specially crafted SQL query. (CVE-2012-3488)

Red Hat would like to thank the PostgreSQL project for reporting this issue. Upstream acknowledges Peter Eisentraut as the original reporter.

All PostgreSQL users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. If the postgresql service is running, it will be automatically restarted after installing this update.

The version of PostgreSQL installed on the remote host is 8.3.x prior to 8.3.20, 8.4.x prior to 8.4.13, 9.0.x prior to 9.0.9, or 9.1.x prior to 9.1.5.  It therefore is potentially affected by multiple vulnerabilities :

  - A flaw in contrib/xml2's xslt_process can be used to     read and write arbitrary files. (CVE-2012-3488)

  - An xml_parse() DTD validation flaw can be used to read     arbitrary files. (CVE-2012-3489)

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-001 applied.  This update contains numerous security-related fixes for the following components :

  - Apache
  - CoreTypes (10.7 only)
  - International Components for Unicode
  - Identity Services (10.7 only)
  - ImageIO
  - Messages Server (Server only)
  - PDFKit
  - Podcast Producer Server (Server only)
  - PostgreSQL (Server only)
  - Profile Manager (10.7 Server only)
  - QuickTime
  - Ruby (10.6 Server only)
  - Security
  - Software Update
  - Wiki Server (10.7 Server only)

Note that the update also runs a malware removal tool that will remove the most common variants of malware.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
64216	SuSE 11.1 Security Update : PostgreSQL (SAT Patch Number 6697)	Nessus	SuSE Local Security Checks	2013/1/25	2021/1/19	medium
74766	openSUSE Security Update : postgresql / postgresql-libs (openSUSE-SU-2012:1251-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
62801	Mac OS X : OS X Server < 2.1.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2012/11/2	2018/7/14	medium
69611	Amazon Linux AMI : postgresql9 (ALAS-2012-121)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2018/4/18	medium
74773	openSUSE Security Update : postgresql (openSUSE-SU-2012:1299-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
83561	SUSE SLED10 / SLES10 Security Update : PostgreSQL (SUSE-SU-2012:1336-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	medium
283949	MiracleLinux 3 : postgresql-8.1.23-6.0.1.AXS3 (AXSA:2012-1005:03)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
61672	Fedora 17 : postgresql-9.1.5-1.fc17 (2012-12165)	Nessus	Fedora Local Security Checks	2012/8/27	2021/1/11	medium
61984	Mandriva Linux Security Advisory : postgresql (MDVSA-2012:139)	Nessus	Mandriva Local Security Checks	2012/9/6	2021/1/6	medium
62083	CentOS 5 / 6 : postgresql / postgresql84 (CESA-2012:1263)	Nessus	CentOS Local Security Checks	2012/9/14	2021/1/4	medium
62089	RHEL 5 : postgresql (RHSA-2012:1264)	Nessus	Red Hat Local Security Checks	2012/9/14	2021/1/14	medium
63354	PostgreSQL 8.3 < 8.3.20 / 8.4 < 8.4.13 / 9.0 < 9.0.9 / 9.1 < 9.1.5 Multiple Vulnerabilities	Nessus	Databases	2012/12/28	2026/1/22	medium
65578	Mac OS X Multiple Vulnerabilities (Security Update 2013-001)	Nessus	MacOS X Local Security Checks	2013/3/15	2024/5/28	high

检测

插件搜索

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

high