RHSA-2008:0040: Moderate: postgresql security update
PostgreSQL is an advanced Object-Relational database management system(DBMS). The postgresql packages include the client programs and librariesneeded to access a PostgreSQL DBMS server.Will Drewry discovered multiple flaws in PostgreSQL's regular expressionengine. An authenticated attacker could use these flaws to cause a denialof service by causing the PostgreSQL server to crash, enter an infiniteloop, or use extensive CPU and memory resources while processing queriescontaining specially crafted regular expressions. Applications that acceptregular expressions from untrusted sources may expose this problem tounauthorized attackers. (CVE-2007-4769, CVE-2007-4772, CVE-2007-6067)A privilege escalation flaw was discovered in PostgreSQL. An authenticatedattacker could create an index function that would be executed withadministrator privileges during database maintenance tasks, such asdatabase vacuuming. (CVE-2007-6600)A privilege escalation flaw was discovered in PostgreSQL's Database Linklibrary (dblink). An authenticated attacker could use dblink to possiblyescalate privileges on systems with "trust" or "ident" authenticationconfigured. Please note that dblink functionality is not enabled bydefault, and can only by enabled by a database administrator on systemswith the postgresql-contrib package installed.(CVE-2007-3278, CVE-2007-6601)All postgresql users should upgrade to these updated packages, whichinclude PostgreSQL 8.1.11 and 8.2.6, and resolve these issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2008:0040?
The severity of RHSA-2008:0040 is generally classified as moderate due to the potential for denial-of-service attacks through flawed regular expression handling.
How do I fix RHSA-2008:0040?
To fix RHSA-2008:0040, you should update your PostgreSQL packages to the latest version provided in the security advisory.
What systems are affected by RHSA-2008:0040?
RHSA-2008:0040 affects PostgreSQL packages across various operating systems that utilize this database management system.
What vulnerabilities are addressed in RHSA-2008:0040?
RHSA-2008:0040 addresses multiple vulnerabilities in PostgreSQL's regular expression engine that can lead to application crashes.
Is it mandatory to apply the patch for RHSA-2008:0040?
While it's not mandatory, it is highly recommended to apply the patch for RHSA-2008:0040 to ensure system stability and security.