REDHAT-BUG-1378043: High severity EnterpriseDB PostgreSQL vulnerability

Published Sep 21, 2016

Updated

The interactive installer used in EnterpriseDB-supplied PostgreSQL packages failed to secure its connection to the download server. Hence, an attacker able to impersonate the download server within a PostgreSQL installation's network scope can execute arbitrary code, as root, during initial installation or when the user directs the installed StackBuilder to acquire additional software. PostgreSQL binaries delivered other ways, such as installations from Yum or Apt packages, are unaffected.

Affected Software

1 affected component

EnterpriseDB PostgreSQL

Event History

Sep 21, 2016

Data Sourced

via Red Hat·11:39 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1378043?

The severity of REDHAT-BUG-1378043 is high due to the potential for arbitrary code execution as root during installation.

How do I fix REDHAT-BUG-1378043?

To fix REDHAT-BUG-1378043, ensure that the installation process uses a secure connection to the download server.

What software is affected by REDHAT-BUG-1378043?

REDHAT-BUG-1378043 affects EnterpriseDB-supplied PostgreSQL packages.

What is the risk associated with REDHAT-BUG-1378043?

The risk associated with REDHAT-BUG-1378043 is that an attacker could impersonate the download server and execute arbitrary code during installation.

How does REDHAT-BUG-1378043 impact PostgreSQL installations?

REDHAT-BUG-1378043 impacts PostgreSQL installations by allowing an attacker to gain root access through a compromised installation process.