CVE-2017-7484

It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access.

It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access.

Robert Haas discovered that some selectivity estimators did not validate user privileges which could result in information disclosure (CVE-2017-7484).

Daniel Gustafsson discovered that the PGREQUIRESSL environment variable did no longer enforce a TLS connection (CVE-2017-7485).

Andrew Wheelwright discovered that user mappings were insufficiently restricted (CVE-2017-7486).

This update for postgresql93 fixes the following issues:

The PostgreSQL package was updated to 9.3.17, bringing various bug and security fixes.

Bug fixes:

• bsc#1029547: Fix tests with timezone 2017a
• CVE-2017-7486: Restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1037624)
• CVE-2017-7485: Recognize PGREQUIRESSL variable again. (bsc#1038293)
• CVE-2017-7484: Prevent exposure of statistical information via leaky operators. (bsc#1037603)

More details can be found in the PostgreSQL release announcements:

• https://www.postgresql.org/docs/9.3/static/release-9-3-17.html
• https://www.postgresql.org/docs/9.3/static/release-9-3-16.html
• https://www.postgresql.org/docs/9.3/static/release-9-3-15.html

This update for postgresql94 to 9.4.12 fixes the following issues:

Upstream changelogs:

• https://www.postgresql.org/docs/9.4/static/release-9-4-12.html
• https://www.postgresql.org/docs/9.4/static/release-9-4-11.html
• https://www.postgresql.org/docs/9.4/static/release-9-4-10.html

Security issues fixed:

• CVE-2017-7486: Restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1037624)

  Please note that manual action is needed to fix this in existing databases See the upstream release notes for details.

• CVE-2017-7485: recognize PGREQUIRESSL variable again. (bsc#1038293)

• CVE-2017-7484: Prevent exposure of statistical information via leaky operators. (bsc#1037603)

Changes in version 9.4.12:

• Build corruption with CREATE INDEX CONCURRENTLY
• Fixes for visibility and write-ahead-log stability

Changes in version 9.4.10:

• Fix WAL-logging of truncation of relation free space maps and visibility maps
• Fix incorrect creation of GIN index WAL records on big-endian machines
• Fix SELECT FOR UPDATE/SHARE to correctly lock tuples that have been updated by a subsequently-aborted transaction
• Fix EvalPlanQual rechecks involving CTE scans
• Fix improper repetition of previous results from hashed aggregation in a subquery

The libraries libpq and libecpg are now supplied by postgresql 9.6.

This update for postgresql93 fixes the following issues:

• bsc#1029547: Fix tests with timezone 2017a
• CVE-2017-7486: Restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1037624)
• CVE-2017-7485: Recognize PGREQUIRESSL variable again. (bsc#1038293)
• CVE-2017-7484: Prevent exposure of statistical information via leaky operators. (bsc#1037603)