| Summary: | dev-db/postgresql-server: multiple vulnerabilites (CVE-2010-{1169,1447,1975}) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Stefan Behte (RETIRED) <craig> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | esigra, pgsql-bugs, titanofold |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.postgresql.org/about/news.1203 | ||
| Whiteboard: | B2 [glsa] | ||
| Package list: | Runtime testing required: | --- | |
| Bug Depends on: | |||
| Bug Blocks: | 297383, 308063, 313335 | ||
|
Description
Stefan Behte (RETIRED)
2010-05-21 22:10:22 UTC
CVE-2010-1447 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1447): PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 does not properly restrict PL/perl procedures, which might allow remote attackers to execute arbitrary Perl code via a crafted script, related to the Safe module (aka Safe.pm) for Perl. CVE-2010-1975 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1975): PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement. All visible ebuilds have been committed, 9.0 is masked and 9.0_beta2 getting committed really soon now arches, please test and mark the following ebuilds stable if possible =dev-db/postgresql-server-7.4.29 TARGET KEYWORDS="alpha amd64 arm hppa ia64 ppc s390 sh sparc x86" =dev-db/postgresql-server-8.0.25 TARGET KEYWORDS="alpha amd64 arm hppa ia64 ppc s390 sh sparc x86" =dev-db/postgresql-server-8.1.21 TARGET KEYWORDS="alpha amd64 arm hppa ia64 s390 sh sparc x86" =dev-db/postgresql-server-8.2.17 TARGET KEYWORDS="alpha amd64 arm hppa ia64 ppc s390 sh sparc x86" =dev-db/postgresql-server-8.3.11 TARGET KEYWORDS="alpha amd64 arm hppa ia64 ~mips ppc ~ppc64 s390 sh sparc x86 ~x86-fbsd" =dev-db/postgresql-server-8.4.4 TARGET KEYWORDS="alpha amd64 arm hppa ia64 ~mips ppc ppc64 s390 sh sparc x86 ~x86-fbsd" No, please don't mark those stable. These are the ones that should be marked stable given enough time:
dev-db/postgresql-docs-{7.4.29,8.0.25,8.1.21,8.2.17,8.3.11,8.4.4}
dev-db/postgresql-base-{7.4.29-r1,8.0.25-r1,8.1.21-r1,8.2.17-r1,8.3.11-r1,8.4.4-r2}
dev-db/postgresql-server-{7.4.29-r1,8.0.25-r1,8.1.21-r1,8.2.17-r1,8.3.11-r1,8.4.4-r1}
Maybe let them sit as ~arch for another week or two. Additionally, the 7.4 branch is no longer supported upstream, so the effort to stabilize them is entirely up to you testers.
(In reply to comment #3) > =dev-db/postgresql-server-7.4.29 > =dev-db/postgresql-server-8.0.25 > =dev-db/postgresql-server-8.1.21 > =dev-db/postgresql-server-8.2.17 > =dev-db/postgresql-server-8.3.11 > =dev-db/postgresql-server-8.4.4 x86 stable, done before Aaron's comment I obviously forgot the split of postgresql into the three packages, so of course the corresponding -base and -docs ebuilds should also be tested. posgresql/Aaron/security: I would not like to wait a week or even longer when marking stable for security bugs. So should we do the -r1 ebuilds or the ones I mentioned? (In reply to comment #6) > I obviously forgot the split of postgresql into the three packages, so of > course the corresponding -base and -docs ebuilds should also be tested. > > posgresql/Aaron/security: > I would not like to wait a week or even longer when marking stable for security > bugs. So should we do the -r1 ebuilds or the ones I mentioned? > If we must stabilize now, I would prefer the ebuilds I've mentioned. They contain many fixes. I would appreciate a short hold for Mr. Lauer to commit the -base-8.4.4-r2 ebuild as the Heimdal patch as applied in 8.4.4-r1 causes the package to fail when it is applied against MIT Kerberos. The -r2 ebuild contains the appropriate conditional. The fixed ebuilds are in the tree now.
To confirm, these are the packages that should be stabilized, with 7.4 being optional:
dev-db/postgresql-docs-{7.4.29,8.0.25,8.1.21,8.2.17,8.3.11,8.4.4}
dev-db/postgresql-base-{7.4.29-r1,8.0.25-r1,8.1.21-r1,8.2.17-r1,8.3.11-r1,8.4.4-r2}
dev-db/postgresql-server-{7.4.29-r1,8.0.25-r1,8.1.21-r1,8.2.17-r1,8.3.11-r1,8.4.4-r1}
All stable for HPPA. amd64 stable alpha/arm/ia64/s390/sh/sparc stable Readding x86 for comment #8 The 7.4 and 8.0 packages have been masked for removal. Obviously, they don't need to be stabilized now. As a reminder: For x86 it is left:
dev-db/postgresql-base-{8.1.21-r1,8.2.17-r1,8.3.11-r1,8.4.4-r2}
dev-db/postgresql-server-{8.1.21-r1,8.2.17-r1,8.3.11-r1,8.4.4-r1}
stable x86 *ping* Given that there are packages that have been masked, I'm updating the list, which is much shorter now.
dev-db/postgresql-docs-{8.1.21,8.2.17,8.3.11,8.4.4}
dev-db/postgresql-base-{8.1.21-r1,8.2.17-r1,8.3.11-r1,8.4.4-r2}
dev-db/postgresql-server-{8.1.21-r1,8.2.17-r1,8.3.11-r1,8.4.4-r1}
Once PPC(64)? AT stabilizes these packages we can remove a few more ebuilds from the tree.
Marked ppc/ppc64 stable. GLSA with #297383. This issue was resolved and addressed in GLSA 201110-22 at http://security.gentoo.org/glsa/glsa-201110-22.xml by GLSA coordinator Alex Legler (a3li). |