Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2016-0766
8.8
HIGHCVSS v3
Published
February 17, 2016
CVSS v2
9 HIGH
Affected
4 projects
Assigned by
Red Hat
Severity scale
010
Description
PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.
PostgreSQL
Chocolatey**PostgreSQL** is a powerful, open-source **object-relational database management system (ORDBMS)**, developed at the **University of California, Berkeley**.
It extends the POSTGRES project and pioneered features later adopted by other commercial systems.
PostgreSQL is **free to use, modify, and distribute** for private, commercial, or academic purposes.
## Features
- See the [Feature Matrix](https://www.postgresql.org/about/featurematrix)
## Package parameters
| Parameter | Description |
|------------|--------------|
| `/AllowRemote` | Enables remote connections (adds entries to `pg_hba.conf`). |
| `/Password` | Sets password for `postgres` user. If omitted, one is generated. Ignored if PostgreSQL already exists. |
| `/Port` | Database server port. Defaults to `5432` or next available port. |
| `/NoPath` | Prevents adding PostgreSQL `bin` directory to `PATH`. |
Other parameters could be set via `--ia` argument, example:
```powershell
choco install postgresql13 --params '/Password:test /Port:5433' --ia '--enable-components server,commandlinetools'
```
Check all [installer](https://www.enterprisedb.com/downloads/postgres-postgresql-downloads) options by adding `--help` as command line argument.
## Notes
- Test installation (specify your password):
`$Env:PGPASSWORD='test'; '\conninfo' | psql -Upostgres`
This should output:
`You are connected to database "postgres" as user "postgres" on host "localhost" at port "5432"`
- This package will install PostgreSQL to `$Env:ProgramFiles\PostgreSQL\[MajorVersion]`.
- If you have problems during installation see [troubleshooting page](https://wiki.postgresql.org/wiki/Troubleshooting_Installation).
- If you didn't specify password during setup and didn't record the generated one, you need manually reset it using the following steps:
- Open file `data\pg_hba.conf` in PostgreSql installation directory
- Change `METHOD` to `trust` and restart service with `Restart-Service postgresql*`
- Execute `"alter user postgres with password '[my password]';" | psql -Upostgres`
- Revert back `data\pg_hba.conf` to METHOD `md5` and restart service
### Virtual package
Each major version has its own package: `postgresql<Version>`
**Virtual package** [postgresql](https://community.chocolatey.org/packages/postgresql) also contains all versions that depend on adequate major version, but using it without problems require some special choco parameters.
To propagate package parameters to dependencies use `--params-global` choco install parameter with virtual package `postgresql`. Assuming latest version is 12, to provide password the following two examples result in identical installation:
```sh
choco install postgresql --params '/Password:test' --params-global
choco install postgresql12 --params '/Password:test'
```
To uninstall dependent package use `--force-dependencies`:
```sh
# The following two examples are identical
choco uninstall postgresql --force-dependencies
choco uninstall postgresql12 postgresql
# This example uninstalls only postgresql virtual package and not postgresql12
choco uninstall postgresql
```
To force reinstallation via virtual package use `--force-dependencies`:
```sh
# The following two examples are identical
choco install postgresql --force --force-dependencies
choco install postgresql12 --force --force-dependencies
# This will reinstall only postgresql virtual package and not its dependency postgresql12
choco install postgresql -force
# This one is different then the first one as vcredist140 dependency is not reinstalled
choco install postgresql12 --force
```
**Please Note**: This is an automatically updated package. If you find it is
out of date by more than a day or two, please contact the maintainer(s) and
let them know [here](https://github.com/mkevenaar/chocolatey-packages/issues) that the package is no longer updating correctly.
Chocolatey**PostgreSQL** is a powerful, open-source **object-relational database management system (ORDBMS)**, developed at the **University of California, Berkeley**.
It extends the POSTGRES project and pioneered features later adopted by other commercial systems.
PostgreSQL is **free to use, modify, and distribute** for private, commercial, or academic purposes.
## Features
- See the [Feature Matrix](https://www.postgresql.org/about/featurematrix)
## Package parameters
| Parameter | Description |
|------------|--------------|
| `/AllowRemote` | Enables remote connections (adds entries to `pg_hba.conf`). |
| `/Password` | Sets password for `postgres` user. If omitted, one is generated. Ignored if PostgreSQL already exists. |
| `/Port` | Database server port. Defaults to `5432` or next available port. |
| `/NoPath` | Prevents adding PostgreSQL `bin` directory to `PATH`. |
Other parameters could be set via `--ia` argument, example:
```powershell
choco install postgresql13 --params '/Password:test /Port:5433' --ia '--enable-components server,commandlinetools'
```
Check all [installer](https://www.enterprisedb.com/downloads/postgres-postgresql-downloads) options by adding `--help` as command line argument.
## Notes
- Test installation (specify your password):
`$Env:PGPASSWORD='test'; '\conninfo' | psql -Upostgres`
This should output:
`You are connected to database "postgres" as user "postgres" on host "localhost" at port "5432"`
- This package will install PostgreSQL to `$Env:ProgramFiles\PostgreSQL\[MajorVersion]`.
- If you have problems during installation see [troubleshooting page](https://wiki.postgresql.org/wiki/Troubleshooting_Installation).
- If you didn't specify password during setup and didn't record the generated one, you need manually reset it using the following steps:
- Open file `data\pg_hba.conf` in PostgreSql installation directory
- Change `METHOD` to `trust` and restart service with `Restart-Service postgresql*`
- Execute `"alter user postgres with password '[my password]';" | psql -Upostgres`
- Revert back `data\pg_hba.conf` to METHOD `md5` and restart service
### Virtual package
Each major version has its own package: `postgresql<Version>`
**Virtual package** [postgresql](https://community.chocolatey.org/packages/postgresql) also contains all versions that depend on adequate major version, but using it without problems require some special choco parameters.
To propagate package parameters to dependencies use `--params-global` choco install parameter with virtual package `postgresql`. Assuming latest version is 12, to provide password the following two examples result in identical installation:
```sh
choco install postgresql --params '/Password:test' --params-global
choco install postgresql12 --params '/Password:test'
```
To uninstall dependent package use `--force-dependencies`:
```sh
# The following two examples are identical
choco uninstall postgresql --force-dependencies
choco uninstall postgresql12 postgresql
# This example uninstalls only postgresql virtual package and not postgresql12
choco uninstall postgresql
```
To force reinstallation via virtual package use `--force-dependencies`:
```sh
# The following two examples are identical
choco install postgresql --force --force-dependencies
choco install postgresql12 --force --force-dependencies
# This will reinstall only postgresql virtual package and not its dependency postgresql12
choco install postgresql -force
# This one is different then the first one as vcredist140 dependency is not reinstalled
choco install postgresql12 --force
```
**Please Note**: This is an automatically updated package. If you find it is
out of date by more than a day or two, please contact the maintainer(s) and
let them know [here](https://github.com/mkevenaar/chocolatey-packages/issues) that the package is no longer updating correctly.
NPM
RubyGems
GitHub