Vulmon
Amazon Linux AMI Security Advisory: ALAS-2021-1476
Advisory Release Date: 2021-01-12 22:52 Pacific
Advisory Updated Date: 2021-01-13 18:30 Pacific
A flaw was found in postgresql. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25694)
A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)
A flaw was found in the psql interactive terminal of PostgreSQL. If an interactive psql session uses \gset when querying a compromised server, this flaw allows an attacker to execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-25696)
Affected Packages:
postgresql95, postgresql96
Issue Correction:
Run yum update postgresql95 to update your system.
Run yum update postgresql96 to update your system.
i686:
postgresql95-contrib-9.5.24-1.82.amzn1.i686
postgresql95-plperl-9.5.24-1.82.amzn1.i686
postgresql95-test-9.5.24-1.82.amzn1.i686
postgresql95-docs-9.5.24-1.82.amzn1.i686
postgresql95-libs-9.5.24-1.82.amzn1.i686
postgresql95-plpython26-9.5.24-1.82.amzn1.i686
postgresql95-static-9.5.24-1.82.amzn1.i686
postgresql95-devel-9.5.24-1.82.amzn1.i686
postgresql95-debuginfo-9.5.24-1.82.amzn1.i686
postgresql95-plpython27-9.5.24-1.82.amzn1.i686
postgresql95-server-9.5.24-1.82.amzn1.i686
postgresql95-9.5.24-1.82.amzn1.i686
postgresql96-test-9.6.20-1.84.amzn1.i686
postgresql96-plpython27-9.6.20-1.84.amzn1.i686
postgresql96-server-9.6.20-1.84.amzn1.i686
postgresql96-debuginfo-9.6.20-1.84.amzn1.i686
postgresql96-devel-9.6.20-1.84.amzn1.i686
postgresql96-plpython26-9.6.20-1.84.amzn1.i686
postgresql96-contrib-9.6.20-1.84.amzn1.i686
postgresql96-libs-9.6.20-1.84.amzn1.i686
postgresql96-plperl-9.6.20-1.84.amzn1.i686
postgresql96-static-9.6.20-1.84.amzn1.i686
postgresql96-9.6.20-1.84.amzn1.i686
postgresql96-docs-9.6.20-1.84.amzn1.i686
src:
postgresql95-9.5.24-1.82.amzn1.src
postgresql96-9.6.20-1.84.amzn1.src
x86_64:
postgresql95-test-9.5.24-1.82.amzn1.x86_64
postgresql95-docs-9.5.24-1.82.amzn1.x86_64
postgresql95-devel-9.5.24-1.82.amzn1.x86_64
postgresql95-libs-9.5.24-1.82.amzn1.x86_64
postgresql95-contrib-9.5.24-1.82.amzn1.x86_64
postgresql95-plperl-9.5.24-1.82.amzn1.x86_64
postgresql95-debuginfo-9.5.24-1.82.amzn1.x86_64
postgresql95-static-9.5.24-1.82.amzn1.x86_64
postgresql95-plpython26-9.5.24-1.82.amzn1.x86_64
postgresql95-server-9.5.24-1.82.amzn1.x86_64
postgresql95-9.5.24-1.82.amzn1.x86_64
postgresql95-plpython27-9.5.24-1.82.amzn1.x86_64
postgresql96-static-9.6.20-1.84.amzn1.x86_64
postgresql96-debuginfo-9.6.20-1.84.amzn1.x86_64
postgresql96-server-9.6.20-1.84.amzn1.x86_64
postgresql96-plpython26-9.6.20-1.84.amzn1.x86_64
postgresql96-test-9.6.20-1.84.amzn1.x86_64
postgresql96-contrib-9.6.20-1.84.amzn1.x86_64
postgresql96-devel-9.6.20-1.84.amzn1.x86_64
postgresql96-docs-9.6.20-1.84.amzn1.x86_64
postgresql96-plperl-9.6.20-1.84.amzn1.x86_64
postgresql96-9.6.20-1.84.amzn1.x86_64
postgresql96-libs-9.6.20-1.84.amzn1.x86_64
postgresql96-plpython27-9.6.20-1.84.amzn1.x86_64