Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS-2017-931

Related Vulnerabilities: CVE-2017-12172   CVE-2017-15098  

Privilege escalation flaws were found in the initialization scripts of PostgreSQL. A remote attacker with access to the postgres user account could use these flaws to obtain root access on the server machine.( CVE-2017-12172) Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL can crash the server or disclose a few bytes of server memory.(CVE-2017-15098)

Source

ALAS-2017-931

Amazon Linux AMI Security Advisory: ALAS-2017-931
Advisory Release Date: 2017-12-05 22:19 Pacific
Advisory Updated Date: 2017-12-06 21:36 Pacific
Severity: Medium
Issue Overview:

Privilege escalation flaws were found in the initialization scripts of PostgreSQL. A remote attacker with access to the postgres user account could use these flaws to obtain root access on the server machine.( CVE-2017-12172)

Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL can crash the server or disclose a few bytes of server memory.(CVE-2017-15098)


Affected Packages:

postgresql92, postgresql93, postgresql94


Issue Correction:
Run yum update postgresql92 to update your system.
Run yum update postgresql93 to update your system.
Run yum update postgresql94 to update your system.

New Packages:
i686:
    postgresql92-plperl-9.2.24-1.65.amzn1.i686
    postgresql92-debuginfo-9.2.24-1.65.amzn1.i686
    postgresql92-server-compat-9.2.24-1.65.amzn1.i686
    postgresql92-plpython27-9.2.24-1.65.amzn1.i686
    postgresql92-devel-9.2.24-1.65.amzn1.i686
    postgresql92-server-9.2.24-1.65.amzn1.i686
    postgresql92-libs-9.2.24-1.65.amzn1.i686
    postgresql92-contrib-9.2.24-1.65.amzn1.i686
    postgresql92-9.2.24-1.65.amzn1.i686
    postgresql92-test-9.2.24-1.65.amzn1.i686
    postgresql92-pltcl-9.2.24-1.65.amzn1.i686
    postgresql92-plpython26-9.2.24-1.65.amzn1.i686
    postgresql92-docs-9.2.24-1.65.amzn1.i686
    postgresql94-plpython27-9.4.15-1.73.amzn1.i686
    postgresql94-debuginfo-9.4.15-1.73.amzn1.i686
    postgresql94-docs-9.4.15-1.73.amzn1.i686
    postgresql94-libs-9.4.15-1.73.amzn1.i686
    postgresql94-devel-9.4.15-1.73.amzn1.i686
    postgresql94-server-9.4.15-1.73.amzn1.i686
    postgresql94-plperl-9.4.15-1.73.amzn1.i686
    postgresql94-9.4.15-1.73.amzn1.i686
    postgresql94-test-9.4.15-1.73.amzn1.i686
    postgresql94-plpython26-9.4.15-1.73.amzn1.i686
    postgresql94-contrib-9.4.15-1.73.amzn1.i686
    postgresql93-pltcl-9.3.20-1.69.amzn1.i686
    postgresql93-test-9.3.20-1.69.amzn1.i686
    postgresql93-plpython26-9.3.20-1.69.amzn1.i686
    postgresql93-libs-9.3.20-1.69.amzn1.i686
    postgresql93-server-9.3.20-1.69.amzn1.i686
    postgresql93-docs-9.3.20-1.69.amzn1.i686
    postgresql93-contrib-9.3.20-1.69.amzn1.i686
    postgresql93-devel-9.3.20-1.69.amzn1.i686
    postgresql93-debuginfo-9.3.20-1.69.amzn1.i686
    postgresql93-plpython27-9.3.20-1.69.amzn1.i686
    postgresql93-9.3.20-1.69.amzn1.i686
    postgresql93-plperl-9.3.20-1.69.amzn1.i686

src:
    postgresql92-9.2.24-1.65.amzn1.src
    postgresql94-9.4.15-1.73.amzn1.src
    postgresql93-9.3.20-1.69.amzn1.src

x86_64:
    postgresql92-docs-9.2.24-1.65.amzn1.x86_64
    postgresql92-plpython27-9.2.24-1.65.amzn1.x86_64
    postgresql92-test-9.2.24-1.65.amzn1.x86_64
    postgresql92-9.2.24-1.65.amzn1.x86_64
    postgresql92-server-compat-9.2.24-1.65.amzn1.x86_64
    postgresql92-pltcl-9.2.24-1.65.amzn1.x86_64
    postgresql92-plperl-9.2.24-1.65.amzn1.x86_64
    postgresql92-devel-9.2.24-1.65.amzn1.x86_64
    postgresql92-server-9.2.24-1.65.amzn1.x86_64
    postgresql92-libs-9.2.24-1.65.amzn1.x86_64
    postgresql92-contrib-9.2.24-1.65.amzn1.x86_64
    postgresql92-plpython26-9.2.24-1.65.amzn1.x86_64
    postgresql92-debuginfo-9.2.24-1.65.amzn1.x86_64
    postgresql94-contrib-9.4.15-1.73.amzn1.x86_64
    postgresql94-plperl-9.4.15-1.73.amzn1.x86_64
    postgresql94-devel-9.4.15-1.73.amzn1.x86_64
    postgresql94-server-9.4.15-1.73.amzn1.x86_64
    postgresql94-libs-9.4.15-1.73.amzn1.x86_64
    postgresql94-plpython26-9.4.15-1.73.amzn1.x86_64
    postgresql94-debuginfo-9.4.15-1.73.amzn1.x86_64
    postgresql94-plpython27-9.4.15-1.73.amzn1.x86_64
    postgresql94-test-9.4.15-1.73.amzn1.x86_64
    postgresql94-9.4.15-1.73.amzn1.x86_64
    postgresql94-docs-9.4.15-1.73.amzn1.x86_64
    postgresql93-server-9.3.20-1.69.amzn1.x86_64
    postgresql93-devel-9.3.20-1.69.amzn1.x86_64
    postgresql93-test-9.3.20-1.69.amzn1.x86_64
    postgresql93-plperl-9.3.20-1.69.amzn1.x86_64
    postgresql93-plpython27-9.3.20-1.69.amzn1.x86_64
    postgresql93-docs-9.3.20-1.69.amzn1.x86_64
    postgresql93-9.3.20-1.69.amzn1.x86_64
    postgresql93-pltcl-9.3.20-1.69.amzn1.x86_64
    postgresql93-contrib-9.3.20-1.69.amzn1.x86_64
    postgresql93-plpython26-9.3.20-1.69.amzn1.x86_64
    postgresql93-libs-9.3.20-1.69.amzn1.x86_64
    postgresql93-debuginfo-9.3.20-1.69.amzn1.x86_64

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started