REDHAT-BUG-522084: High severity postgresql common vulnerability
Quoting upstream PostgreSQL security page: http://www.postgresql.org/support/security.html
If PostgreSQL is configured with LDAP authentication, and your LDAP configuration allows anonymous binds, it is possible for a user to authenticate themselves with an empty password.
Affected versions: 8.3, 8.2
Fixed in versions: 8.3.8, 8.2.14
Severity: A - A vulnerability that is exploitable for privilege escalation without requiring a prior login.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-522084?
The severity of REDHAT-BUG-522084 is medium as it involves potential unauthorized access through LDAP authentication.
How do I fix REDHAT-BUG-522084?
To fix REDHAT-BUG-522084, configure your LDAP to disallow anonymous binds when using PostgreSQL.
Which versions of PostgreSQL are affected by REDHAT-BUG-522084?
PostgreSQL versions 8.2 to 8.3 are affected by REDHAT-BUG-522084.
What type of authentication vulnerability is described in REDHAT-BUG-522084?
REDHAT-BUG-522084 describes a vulnerability related to LDAP authentication allowing for anonymous binds.
Is REDHAT-BUG-522084 applicable to non-LDAP authentication?
No, REDHAT-BUG-522084 specifically pertains to PostgreSQL configured with LDAP authentication.