CVE-2016-7048: Critical severity postgresql common vulnerability
The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by leveraging use of HTTP to download software.
Other sources
The interactive installer used in EnterpriseDB-supplied PostgreSQL packages failed to secure its connection to the download server. Hence, an attacker able to impersonate the download server within a PostgreSQL installation's network scope can execute arbitrary code, as root, during initial installation or when the user directs the installed StackBuilder to acquire additional software. PostgreSQL binaries delivered other ways, such as installations from Yum or Apt packages, are unaffected.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7048?
CVE-2016-7048 has a medium severity rating due to its potential to allow remote code execution.
How do I fix CVE-2016-7048?
To fix CVE-2016-7048, upgrade to PostgreSQL version 9.3.15, 9.4.10, or 9.5.5 or later.
Who is affected by CVE-2016-7048?
CVE-2016-7048 affects PostgreSQL versions before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5.
What kind of attack can CVE-2016-7048 facilitate?
CVE-2016-7048 can facilitate remote code execution attacks through the insecure use of HTTP in the interactive installer.
Is there a workaround for CVE-2016-7048?
The best recommendation for CVE-2016-7048 is to upgrade to a secure version as there are no effective workarounds.