- Issued:
- 2007-05-03
- Updated:
- 2007-05-03
RHSA-2007:0337 - Security Advisory
Synopsis
Moderate: postgresql security update
Type/Severity
Security Advisory: Moderate
Topic
Updated postgresql packages that fix several security vulnerabilities are
now available for the Red Hat Application Stack.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
Description
PostgreSQL is an advanced Object-Relational database management system
(DBMS).
A flaw was found in the way PostgreSQL allows authenticated users to
execute security-definer functions. It was possible for an unprivileged
user to execute arbitrary code with the privileges of the security-definer
function. (CVE-2007-2138)
Users of PostgreSQL should upgrade to these updated packages containing
PostgreSQL version 8.1.9 which corrects this issue.
Solution
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
Affected Products
- Red Hat Application Stack 1 1 x86_64
- Red Hat Application Stack 1 1 i386
Fixes
- BZ - 237681 - CVE-2007-2138 PostgreSQL security-definer function privilege escalation
CVEs
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.