Security Features in PostgreSQL - CVE-2016-2193

Vulnerability identifier: #VU40402

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-2193

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to manipulate data.

PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass intended access restrictions by leveraging a session that performs queries as more than one role.

PostgreSQL
Amazon Linux AMI
Anolis OS
openEuler
IBM Security QRadar Network Threat Analytics
IBM Cloud Pak for Watson AIOps
Guardium Data Protection
IBM Sterling Connect:Direct Web Services
postgres-decoderbufs
pgaudit
pg_repack
postgresql-contrib
postgresql
postgresql-docs
postgresql-plperl
postgresql-pltcl
postgresql-test-rpm-macros
postgresql-upgrade-devel
postgresql-upgrade
postgresql-test
postgresql-static
postgresql-server-devel
postgresql-plpython3
postgresql-server
libpq
libpq-debuginfo
libpq-debugsource
libpq-devel
postgresql-private-libs
postgresql-private-devel
postgresql-llvmjit
postgresql-debugsource
postgresql-debuginfo
postgresql-13-static
postgresql-13
postgresql-13-contrib
postgresql-13-debuginfo
postgresql-13-debugsource
postgresql-13-docs
postgresql-13-test-rpm-macros
postgresql-13-test
postgresql-13-llvmjit
postgresql-13-server-devel
postgresql-13-server
postgresql-13-private-libs
postgresql-13-private-devel
postgresql-13-pltcl
postgresql-13-plpython3
postgresql-13-plperl
postgresql15
Juniper Secure Analytics (JSA)

Install update from vendor's website.

IBM Security QRadar Network Threat Analytics - update to 1.4.3
IBM Sterling Connect:Direct Web Services - update to 6.1.0.27
postgres-decoderbufs - addressed in versions 0.10.0-2, 1.9.7-1.Final
pgaudit - addressed in versions 1.4.0-7, 1.5.0-1, 1.7.0-1
pg_repack - addressed in versions 1.4.6-3, 1.4.8-1
IBM Cloud Pak for Watson AIOps - update to 4.8.1
Juniper Secure Analytics (JSA) - update to 7.5.0 UP11 IF03
Guardium Data Protection - addressed in versions 12.0p35, 12.0p115
postgresql-contrib - addressed in versions 12.22-1.0.1, 13.18-1.0.1, 15.10-1.0.1
postgresql - addressed in versions 12.22-1.0.1, 13.18-1.0.1, 15.10-1.0.1
postgresql-docs - addressed in versions 12.22-1.0.1, 13.18-1.0.1, 15.10-1.0.1
postgresql-plperl - addressed in versions 12.22-1.0.1, 13.18-1.0.1, 15.10-1.0.1
postgresql-pltcl - addressed in versions 12.22-1.0.1, 13.18-1.0.1, 15.10-1.0.1
postgresql-test-rpm-macros - addressed in versions 12.22-1.0.1, 13.18-1.0.1, 15.10-1.0.1
postgresql-upgrade-devel - addressed in versions 12.22-1.0.1, 13.18-1.0.1, 15.10-1.0.1
postgresql-upgrade - addressed in versions 12.22-1.0.1, 13.18-1.0.1, 15.10-1.0.1
postgresql-test - addressed in versions 12.22-1.0.1, 13.18-1.0.1, 15.10-1.0.1
postgresql-static - addressed in versions 12.22-1.0.1, 13.18-1.0.1, 15.10-1.0.1
postgresql-server-devel - addressed in versions 12.22-1.0.1, 13.18-1.0.1, 15.10-1.0.1
postgresql-plpython3 - addressed in versions 12.22-1.0.1, 13.18-1.0.1, 15.10-1.0.1
postgresql-server - addressed in versions 12.22-1.0.1, 13.18-1.0.1, 15.10-1.0.1
postgresql-static - addressed in versions 13.17-1, 15.9-1
postgresql-test - addressed in versions 13.17-1, 15.9-1
postgresql-test-rpm-macros - addressed in versions 13.17-1, 15.9-1
libpq - addressed in versions 13.17-1, 15.9-1
libpq-debuginfo - addressed in versions 13.17-1, 15.9-1
libpq-debugsource - addressed in versions 13.17-1, 15.9-1
libpq-devel - addressed in versions 13.17-1, 15.9-1
postgresql - addressed in versions 13.17-1, 15.9-1
postgresql-server-devel - addressed in versions 13.17-1, 15.9-1
postgresql-server - addressed in versions 13.17-1, 15.9-1
postgresql-private-libs - addressed in versions 13.17-1, 15.9-1
postgresql-private-devel - addressed in versions 13.17-1, 15.9-1
postgresql-pltcl - addressed in versions 13.17-1, 15.9-1
postgresql-plpython3 - addressed in versions 13.17-1, 15.9-1
postgresql-plperl - addressed in versions 13.17-1, 15.9-1
postgresql-llvmjit - addressed in versions 13.17-1, 15.9-1
postgresql-docs - addressed in versions 13.17-1, 15.9-1
postgresql-debugsource - addressed in versions 13.17-1, 15.9-1
postgresql-debuginfo - addressed in versions 13.17-1, 15.9-1
postgresql-contrib - addressed in versions 13.17-1, 15.9-1
postgresql-13-static - update to 13.20-1
postgresql-13 - update to 13.20-1
postgresql-13-contrib - update to 13.20-1
postgresql-13-debuginfo - update to 13.20-1
postgresql-13-debugsource - update to 13.20-1
postgresql-13-docs - update to 13.20-1
postgresql-13-test-rpm-macros - update to 13.20-1
postgresql-13-test - update to 13.20-1
postgresql-13-llvmjit - update to 13.20-1
postgresql-13-server-devel - update to 13.20-1
postgresql-13-server - update to 13.20-1
postgresql-13-private-libs - update to 13.20-1
postgresql-13-private-devel - update to 13.20-1
postgresql-13-pltcl - update to 13.20-1
postgresql-13-plpython3 - update to 13.20-1
postgresql-13-plperl - update to 13.20-1
postgresql15 - update to 15.4-1
postgresql-private-libs - update to 15.10-1.0.1
postgresql-private-devel - update to 15.10-1.0.1

• http://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=db69e58a0642ef7fa46d62f6c4cf2460c3a1b41b
• http://www.postgresql.org/about/news/1656/
• http://www.postgresql.org/docs/current/static/release-9-5-2.html
• http://www.securitytracker.com/id/1035468

• Multiple vulnerabilities in PostgreSQL
• openEuler 22.03 LTS SP1 update for postgresql
• openEuler 22.03 LTS SP3 update for postgresql
• openEuler 22.03 LTS SP4 update for postgresql
• openEuler 24.03 LTS update for postgresql
• openEuler 22.03 LTS SP4 update for libpq
• openEuler 24.03 LTS update for libpq
• openEuler 22.03 LTS SP1 update for libpq
• openEuler 22.03 LTS SP3 update for libpq
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Amazon Linux AMI update for postgresql15
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• Anolis OS update for postgresql:12 module
• Anolis OS update for postgresql:13 module
• Anolis OS update for postgresql:15 module
• openEuler 20.03 LTS SP4 update for postgresql-13
• Multiple vulnerabilities in IBM Guardium Data Protection
• Juniper Secure Analytics update for third-party components
• Multiple vulnerabilities in IBM Network Threat Analytics