Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2018-1053
3.3
LOWCVSS v2
Published
February 9, 2018
Affected
4 projects
Assigned by
Red Hat
Severity scale
010
Description
In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.
PostgreSQL
Chocolatey**PostgreSQL** is a powerful, open-source **object-relational database management system (ORDBMS)**, developed at the **University of California, Berkeley**.
It extends the POSTGRES project and pioneered features later adopted by other commercial systems.
PostgreSQL is **free to use, modify, and distribute** for private, commercial, or academic purposes.
## Features
- See the [Feature Matrix](https://www.postgresql.org/about/featurematrix)
## Package parameters
| Parameter | Description |
|------------|--------------|
| `/AllowRemote` | Enables remote connections (adds entries to `pg_hba.conf`). |
| `/Password` | Sets password for `postgres` user. If omitted, one is generated. Ignored if PostgreSQL already exists. |
| `/Port` | Database server port. Defaults to `5432` or next available port. |
| `/NoPath` | Prevents adding PostgreSQL `bin` directory to `PATH`. |
Other parameters could be set via `--ia` argument, example:
```powershell
choco install postgresql13 --params '/Password:test /Port:5433' --ia '--enable-components server,commandlinetools'
```
Check all [installer](https://www.enterprisedb.com/downloads/postgres-postgresql-downloads) options by adding `--help` as command line argument.
## Notes
- Test installation (specify your password):
`$Env:PGPASSWORD='test'; '\conninfo' | psql -Upostgres`
This should output:
`You are connected to database "postgres" as user "postgres" on host "localhost" at port "5432"`
- This package will install PostgreSQL to `$Env:ProgramFiles\PostgreSQL\[MajorVersion]`.
- If you have problems during installation see [troubleshooting page](https://wiki.postgresql.org/wiki/Troubleshooting_Installation).
- If you didn't specify password during setup and didn't record the generated one, you need manually reset it using the following steps:
- Open file `data\pg_hba.conf` in PostgreSql installation directory
- Change `METHOD` to `trust` and restart service with `Restart-Service postgresql*`
- Execute `"alter user postgres with password '[my password]';" | psql -Upostgres`
- Revert back `data\pg_hba.conf` to METHOD `md5` and restart service
### Virtual package
Each major version has its own package: `postgresql<Version>`
**Virtual package** [postgresql](https://community.chocolatey.org/packages/postgresql) also contains all versions that depend on adequate major version, but using it without problems require some special choco parameters.
To propagate package parameters to dependencies use `--params-global` choco install parameter with virtual package `postgresql`. Assuming latest version is 12, to provide password the following two examples result in identical installation:
```sh
choco install postgresql --params '/Password:test' --params-global
choco install postgresql12 --params '/Password:test'
```
To uninstall dependent package use `--force-dependencies`:
```sh
# The following two examples are identical
choco uninstall postgresql --force-dependencies
choco uninstall postgresql12 postgresql
# This example uninstalls only postgresql virtual package and not postgresql12
choco uninstall postgresql
```
To force reinstallation via virtual package use `--force-dependencies`:
```sh
# The following two examples are identical
choco install postgresql --force --force-dependencies
choco install postgresql12 --force --force-dependencies
# This will reinstall only postgresql virtual package and not its dependency postgresql12
choco install postgresql -force
# This one is different then the first one as vcredist140 dependency is not reinstalled
choco install postgresql12 --force
```
**Please Note**: This is an automatically updated package. If you find it is
out of date by more than a day or two, please contact the maintainer(s) and
let them know [here](https://github.com/mkevenaar/chocolatey-packages/issues) that the package is no longer updating correctly.
Chocolatey**PostgreSQL** is a powerful, open-source **object-relational database management system (ORDBMS)**, developed at the **University of California, Berkeley**.
It extends the POSTGRES project and pioneered features later adopted by other commercial systems.
PostgreSQL is **free to use, modify, and distribute** for private, commercial, or academic purposes.
## Features
- See the [Feature Matrix](https://www.postgresql.org/about/featurematrix)
## Package parameters
| Parameter | Description |
|------------|--------------|
| `/AllowRemote` | Enables remote connections (adds entries to `pg_hba.conf`). |
| `/Password` | Sets password for `postgres` user. If omitted, one is generated. Ignored if PostgreSQL already exists. |
| `/Port` | Database server port. Defaults to `5432` or next available port. |
| `/NoPath` | Prevents adding PostgreSQL `bin` directory to `PATH`. |
Other parameters could be set via `--ia` argument, example:
```powershell
choco install postgresql13 --params '/Password:test /Port:5433' --ia '--enable-components server,commandlinetools'
```
Check all [installer](https://www.enterprisedb.com/downloads/postgres-postgresql-downloads) options by adding `--help` as command line argument.
## Notes
- Test installation (specify your password):
`$Env:PGPASSWORD='test'; '\conninfo' | psql -Upostgres`
This should output:
`You are connected to database "postgres" as user "postgres" on host "localhost" at port "5432"`
- This package will install PostgreSQL to `$Env:ProgramFiles\PostgreSQL\[MajorVersion]`.
- If you have problems during installation see [troubleshooting page](https://wiki.postgresql.org/wiki/Troubleshooting_Installation).
- If you didn't specify password during setup and didn't record the generated one, you need manually reset it using the following steps:
- Open file `data\pg_hba.conf` in PostgreSql installation directory
- Change `METHOD` to `trust` and restart service with `Restart-Service postgresql*`
- Execute `"alter user postgres with password '[my password]';" | psql -Upostgres`
- Revert back `data\pg_hba.conf` to METHOD `md5` and restart service
### Virtual package
Each major version has its own package: `postgresql<Version>`
**Virtual package** [postgresql](https://community.chocolatey.org/packages/postgresql) also contains all versions that depend on adequate major version, but using it without problems require some special choco parameters.
To propagate package parameters to dependencies use `--params-global` choco install parameter with virtual package `postgresql`. Assuming latest version is 12, to provide password the following two examples result in identical installation:
```sh
choco install postgresql --params '/Password:test' --params-global
choco install postgresql12 --params '/Password:test'
```
To uninstall dependent package use `--force-dependencies`:
```sh
# The following two examples are identical
choco uninstall postgresql --force-dependencies
choco uninstall postgresql12 postgresql
# This example uninstalls only postgresql virtual package and not postgresql12
choco uninstall postgresql
```
To force reinstallation via virtual package use `--force-dependencies`:
```sh
# The following two examples are identical
choco install postgresql --force --force-dependencies
choco install postgresql12 --force --force-dependencies
# This will reinstall only postgresql virtual package and not its dependency postgresql12
choco install postgresql -force
# This one is different then the first one as vcredist140 dependency is not reinstalled
choco install postgresql12 --force
```
**Please Note**: This is an automatically updated package. If you find it is
out of date by more than a day or two, please contact the maintainer(s) and
let them know [here](https://github.com/mkevenaar/chocolatey-packages/issues) that the package is no longer updating correctly.
NPM
RubyGems
GitHub