ALAS-2021-1476


Amazon Linux AMI Security Advisory: ALAS-2021-1476
Advisory Release Date: 2021-01-12 22:52 Pacific
Advisory Updated Date: 2021-01-13 18:30 Pacific
Severity: Important

Issue Overview:

A flaw was found in postgresql. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25694 )

A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695 )

A flaw was found in the psql interactive terminal of PostgreSQL. If an interactive psql session uses \gset when querying a compromised server, this flaw allows an attacker to execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-25696 )


Affected Packages:

postgresql95, postgresql96


Issue Correction:
Run yum update postgresql95 to update your system.
Run yum update postgresql96 to update your system.

New Packages:
i686:
    postgresql95-contrib-9.5.24-1.82.amzn1.i686
    postgresql95-plperl-9.5.24-1.82.amzn1.i686
    postgresql95-test-9.5.24-1.82.amzn1.i686
    postgresql95-docs-9.5.24-1.82.amzn1.i686
    postgresql95-libs-9.5.24-1.82.amzn1.i686
    postgresql95-plpython26-9.5.24-1.82.amzn1.i686
    postgresql95-static-9.5.24-1.82.amzn1.i686
    postgresql95-devel-9.5.24-1.82.amzn1.i686
    postgresql95-debuginfo-9.5.24-1.82.amzn1.i686
    postgresql95-plpython27-9.5.24-1.82.amzn1.i686
    postgresql95-server-9.5.24-1.82.amzn1.i686
    postgresql95-9.5.24-1.82.amzn1.i686
    postgresql96-test-9.6.20-1.84.amzn1.i686
    postgresql96-plpython27-9.6.20-1.84.amzn1.i686
    postgresql96-server-9.6.20-1.84.amzn1.i686
    postgresql96-debuginfo-9.6.20-1.84.amzn1.i686
    postgresql96-devel-9.6.20-1.84.amzn1.i686
    postgresql96-plpython26-9.6.20-1.84.amzn1.i686
    postgresql96-contrib-9.6.20-1.84.amzn1.i686
    postgresql96-libs-9.6.20-1.84.amzn1.i686
    postgresql96-plperl-9.6.20-1.84.amzn1.i686
    postgresql96-static-9.6.20-1.84.amzn1.i686
    postgresql96-9.6.20-1.84.amzn1.i686
    postgresql96-docs-9.6.20-1.84.amzn1.i686

src:
    postgresql95-9.5.24-1.82.amzn1.src
    postgresql96-9.6.20-1.84.amzn1.src

x86_64:
    postgresql95-test-9.5.24-1.82.amzn1.x86_64
    postgresql95-docs-9.5.24-1.82.amzn1.x86_64
    postgresql95-devel-9.5.24-1.82.amzn1.x86_64
    postgresql95-libs-9.5.24-1.82.amzn1.x86_64
    postgresql95-contrib-9.5.24-1.82.amzn1.x86_64
    postgresql95-plperl-9.5.24-1.82.amzn1.x86_64
    postgresql95-debuginfo-9.5.24-1.82.amzn1.x86_64
    postgresql95-static-9.5.24-1.82.amzn1.x86_64
    postgresql95-plpython26-9.5.24-1.82.amzn1.x86_64
    postgresql95-server-9.5.24-1.82.amzn1.x86_64
    postgresql95-9.5.24-1.82.amzn1.x86_64
    postgresql95-plpython27-9.5.24-1.82.amzn1.x86_64
    postgresql96-static-9.6.20-1.84.amzn1.x86_64
    postgresql96-debuginfo-9.6.20-1.84.amzn1.x86_64
    postgresql96-server-9.6.20-1.84.amzn1.x86_64
    postgresql96-plpython26-9.6.20-1.84.amzn1.x86_64
    postgresql96-test-9.6.20-1.84.amzn1.x86_64
    postgresql96-contrib-9.6.20-1.84.amzn1.x86_64
    postgresql96-devel-9.6.20-1.84.amzn1.x86_64
    postgresql96-docs-9.6.20-1.84.amzn1.x86_64
    postgresql96-plperl-9.6.20-1.84.amzn1.x86_64
    postgresql96-9.6.20-1.84.amzn1.x86_64
    postgresql96-libs-9.6.20-1.84.amzn1.x86_64
    postgresql96-plpython27-9.6.20-1.84.amzn1.x86_64