Mageia alert MGASA-2018-0137 (postgresql)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2018-0137: Updated postgresql packages fix security vulnerability 
Date:
    	     
 
Sun, 25 Feb 2018 00:26:06 +0100
Message-ID:
    	     
 
<20180224232606.A03FB9FD12@duvel.mageia.org>
MGASA-2018-0137 - Updated postgresql packages fix security vulnerability

Publication date: 24 Feb 2018
URL: https://advisories.mageia.org/MGASA-2018-0137.html
Type: security
Affected Mageia releases: 5, 6
CVE: CVE-2018-1053

Description:
In postgresql 9.4.x before 9.4.16 and 9.6.x before 9.6.7, pg_upgrade creates
file in current working directory containing the output of `pg_dumpall -g`
under umask which was in effect when the user invoked pg_upgrade, and not
under 0077 which is normally used for other temporary files. This can allow
an authenticated attacker to read or modify the one file, which may contain
encrypted or unencrypted database passwords. The attack is infeasible if a
directory mode blocks the attacker searching the current working directory or
if the prevailing umask blocks the attacker opening the file (CVE-2018-1053).

Note that on Mageia 5, only the postgresql9.4 update is being provided.  Users
of the postgresql9.3 package should migrate to 9.4.

References:
- https://bugs.mageia.org/show_bug.cgi?id=22556
- https://www.postgresql.org/docs/9.4/static/release-9-4-16...
- https://www.postgresql.org/docs/9.6/static/release-9-6-7....
- https://www.postgresql.org/about/news/1829/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1053

SRPMS:
- 5/core/postgresql9.4-9.4.16-1.mga5
- 6/core/postgresql9.4-9.4.16-1.mga6
- 6/core/postgresql9.6-9.6.7-1.mga6