Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2017-7486
5
MEDIUMCVSS v2
Published
May 12, 2017
Affected
4 projects
Assigned by
Red Hat
Severity scale
010
Description
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.
PostgreSQL
Chocolatey**PostgreSQL** is a powerful, open-source **object-relational database management system (ORDBMS)**, developed at the **University of California, Berkeley**.
It extends the POSTGRES project and pioneered features later adopted by other commercial systems.
PostgreSQL is **free to use, modify, and distribute** for private, commercial, or academic purposes.
## Features
- See the [Feature Matrix](https://www.postgresql.org/about/featurematrix)
## Package parameters
| Parameter | Description |
|------------|--------------|
| `/AllowRemote` | Enables remote connections (adds entries to `pg_hba.conf`). |
| `/Password` | Sets password for `postgres` user. If omitted, one is generated. Ignored if PostgreSQL already exists. |
| `/Port` | Database server port. Defaults to `5432` or next available port. |
| `/NoPath` | Prevents adding PostgreSQL `bin` directory to `PATH`. |
Other parameters could be set via `--ia` argument, example:
```powershell
choco install postgresql13 --params '/Password:test /Port:5433' --ia '--enable-components server,commandlinetools'
```
Check all [installer](https://www.enterprisedb.com/downloads/postgres-postgresql-downloads) options by adding `--help` as command line argument.
## Notes
- Test installation (specify your password):
`$Env:PGPASSWORD='test'; '\conninfo' | psql -Upostgres`
This should output:
`You are connected to database "postgres" as user "postgres" on host "localhost" at port "5432"`
- This package will install PostgreSQL to `$Env:ProgramFiles\PostgreSQL\[MajorVersion]`.
- If you have problems during installation see [troubleshooting page](https://wiki.postgresql.org/wiki/Troubleshooting_Installation).
- If you didn't specify password during setup and didn't record the generated one, you need manually reset it using the following steps:
- Open file `data\pg_hba.conf` in PostgreSql installation directory
- Change `METHOD` to `trust` and restart service with `Restart-Service postgresql*`
- Execute `"alter user postgres with password '[my password]';" | psql -Upostgres`
- Revert back `data\pg_hba.conf` to METHOD `md5` and restart service
### Virtual package
Each major version has its own package: `postgresql<Version>`
**Virtual package** [postgresql](https://community.chocolatey.org/packages/postgresql) also contains all versions that depend on adequate major version, but using it without problems require some special choco parameters.
To propagate package parameters to dependencies use `--params-global` choco install parameter with virtual package `postgresql`. Assuming latest version is 12, to provide password the following two examples result in identical installation:
```sh
choco install postgresql --params '/Password:test' --params-global
choco install postgresql12 --params '/Password:test'
```
To uninstall dependent package use `--force-dependencies`:
```sh
# The following two examples are identical
choco uninstall postgresql --force-dependencies
choco uninstall postgresql12 postgresql
# This example uninstalls only postgresql virtual package and not postgresql12
choco uninstall postgresql
```
To force reinstallation via virtual package use `--force-dependencies`:
```sh
# The following two examples are identical
choco install postgresql --force --force-dependencies
choco install postgresql12 --force --force-dependencies
# This will reinstall only postgresql virtual package and not its dependency postgresql12
choco install postgresql -force
# This one is different then the first one as vcredist140 dependency is not reinstalled
choco install postgresql12 --force
```
**Please Note**: This is an automatically updated package. If you find it is
out of date by more than a day or two, please contact the maintainer(s) and
let them know [here](https://github.com/mkevenaar/chocolatey-packages/issues) that the package is no longer updating correctly.
Chocolatey**PostgreSQL** is a powerful, open-source **object-relational database management system (ORDBMS)**, developed at the **University of California, Berkeley**.
It extends the POSTGRES project and pioneered features later adopted by other commercial systems.
PostgreSQL is **free to use, modify, and distribute** for private, commercial, or academic purposes.
## Features
- See the [Feature Matrix](https://www.postgresql.org/about/featurematrix)
## Package parameters
| Parameter | Description |
|------------|--------------|
| `/AllowRemote` | Enables remote connections (adds entries to `pg_hba.conf`). |
| `/Password` | Sets password for `postgres` user. If omitted, one is generated. Ignored if PostgreSQL already exists. |
| `/Port` | Database server port. Defaults to `5432` or next available port. |
| `/NoPath` | Prevents adding PostgreSQL `bin` directory to `PATH`. |
Other parameters could be set via `--ia` argument, example:
```powershell
choco install postgresql13 --params '/Password:test /Port:5433' --ia '--enable-components server,commandlinetools'
```
Check all [installer](https://www.enterprisedb.com/downloads/postgres-postgresql-downloads) options by adding `--help` as command line argument.
## Notes
- Test installation (specify your password):
`$Env:PGPASSWORD='test'; '\conninfo' | psql -Upostgres`
This should output:
`You are connected to database "postgres" as user "postgres" on host "localhost" at port "5432"`
- This package will install PostgreSQL to `$Env:ProgramFiles\PostgreSQL\[MajorVersion]`.
- If you have problems during installation see [troubleshooting page](https://wiki.postgresql.org/wiki/Troubleshooting_Installation).
- If you didn't specify password during setup and didn't record the generated one, you need manually reset it using the following steps:
- Open file `data\pg_hba.conf` in PostgreSql installation directory
- Change `METHOD` to `trust` and restart service with `Restart-Service postgresql*`
- Execute `"alter user postgres with password '[my password]';" | psql -Upostgres`
- Revert back `data\pg_hba.conf` to METHOD `md5` and restart service
### Virtual package
Each major version has its own package: `postgresql<Version>`
**Virtual package** [postgresql](https://community.chocolatey.org/packages/postgresql) also contains all versions that depend on adequate major version, but using it without problems require some special choco parameters.
To propagate package parameters to dependencies use `--params-global` choco install parameter with virtual package `postgresql`. Assuming latest version is 12, to provide password the following two examples result in identical installation:
```sh
choco install postgresql --params '/Password:test' --params-global
choco install postgresql12 --params '/Password:test'
```
To uninstall dependent package use `--force-dependencies`:
```sh
# The following two examples are identical
choco uninstall postgresql --force-dependencies
choco uninstall postgresql12 postgresql
# This example uninstalls only postgresql virtual package and not postgresql12
choco uninstall postgresql
```
To force reinstallation via virtual package use `--force-dependencies`:
```sh
# The following two examples are identical
choco install postgresql --force --force-dependencies
choco install postgresql12 --force --force-dependencies
# This will reinstall only postgresql virtual package and not its dependency postgresql12
choco install postgresql -force
# This one is different then the first one as vcredist140 dependency is not reinstalled
choco install postgresql12 --force
```
**Please Note**: This is an automatically updated package. If you find it is
out of date by more than a day or two, please contact the maintainer(s) and
let them know [here](https://github.com/mkevenaar/chocolatey-packages/issues) that the package is no longer updating correctly.
NPM
RubyGems
GitHub