Security Update for postgresql-9.1
Summary
DLA-1271-1: postgresql-9.1 - security update. Affects postgresql-9.1 versions < 9.1.24lts2-0+deb7u2. Fixed in 9.1.24lts2-0+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an open-source relational database management system known for its robustness, scalability, and extensibility. It provides a wide range of features and is widely used in various applications. The vulnerability affects the postgresql-9.1 package in Debian 7 Wheezy, which is a long-term support (LTS) version of Debian. This package is used to install and manage PostgreSQL database clusters.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1053, was discovered by Tom Lane. It affects the pg_upgrade tool, which is used to upgrade PostgreSQL database clusters. The tool creates temporary files that contain password hashes, and these files are world-readable. This means that unauthorized users may be able to access these files and potentially obtain sensitive information, such as password hashes. This vulnerability poses a risk to the security of the PostgreSQL database system and the data stored within it.
How To Fix
Minimum fixed version
9.1.24lts2-0+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade postgresql-9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to apply the security update by upgrading the postgresql-9.1 package.
Conclusion
In conclusion, the postgresql-9.1 package in Debian 7 Wheezy is vulnerable to a security issue (CVE-2018-1053) that allows unauthorized access to password hashes. To mitigate this vulnerability, it is recommended to upgrade the package to version 9.1.24lts2-0+deb7u2. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql-9.1 →
FAQ
PostgreSQL is an open-source relational database management system known for its robustness, scalability, and extensibility. It provides a wide range of features and is widely used in various applications.
This vulnerability allows unauthorized users to access temporary files containing password hashes. This could potentially lead to the compromise of sensitive information, such as user passwords.
You can check the version of postgresql-9.1 installed on your system by running the command 'dpkg -l postgresql-9.1' in the terminal.
The upgrade process for the postgresql-9.1 package is designed to preserve data. However, it is always recommended to perform a backup of the database before proceeding with any upgrades or updates.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, on the Debian LTS wiki: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-9.1.
