Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2021-3677
6.5
MEDIUMCVSS v3
Published
March 2, 2022
CVSS v2
4 MEDIUM
Affected
10 projects
Assigned by
Red Hat
Severity scale
010
Description
A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.
postgresql
Crates.ioA metal asynchronous drive for PostgreSQL
Crates.ioA metal asynchronous drive for PostgreSQL>= 13.0, < 13.4, >= 12.0, < 12.8, >= 11.0, < 11.13NVD
PostgreSQL
Chocolatey**PostgreSQL** is a powerful, open-source **object-relational database management system (ORDBMS)**, developed at the **University of California, Berkeley**.
It extends the POSTGRES project and pioneered features later adopted by other commercial systems.
PostgreSQL is **free to use, modify, and distribute** for private, commercial, or academic purposes.
## Features
- See the [Feature Matrix](https://www.postgresql.org/about/featurematrix)
## Package parameters
| Parameter | Description |
|------------|--------------|
| `/AllowRemote` | Enables remote connections (adds entries to `pg_hba.conf`). |
| `/Password` | Sets password for `postgres` user. If omitted, one is generated. Ignored if PostgreSQL already exists. |
| `/Port` | Database server port. Defaults to `5432` or next available port. |
| `/NoPath` | Prevents adding PostgreSQL `bin` directory to `PATH`. |
Other parameters could be set via `--ia` argument, example:
```powershell
choco install postgresql13 --params '/Password:test /Port:5433' --ia '--enable-components server,commandlinetools'
```
Check all [installer](https://www.enterprisedb.com/downloads/postgres-postgresql-downloads) options by adding `--help` as command line argument.
## Notes
- Test installation (specify your password):
`$Env:PGPASSWORD='test'; '\conninfo' | psql -Upostgres`
This should output:
`You are connected to database "postgres" as user "postgres" on host "localhost" at port "5432"`
- This package will install PostgreSQL to `$Env:ProgramFiles\PostgreSQL\[MajorVersion]`.
- If you have problems during installation see [troubleshooting page](https://wiki.postgresql.org/wiki/Troubleshooting_Installation).
- If you didn't specify password during setup and didn't record the generated one, you need manually reset it using the following steps:
- Open file `data\pg_hba.conf` in PostgreSql installation directory
- Change `METHOD` to `trust` and restart service with `Restart-Service postgresql*`
- Execute `"alter user postgres with password '[my password]';" | psql -Upostgres`
- Revert back `data\pg_hba.conf` to METHOD `md5` and restart service
### Virtual package
Each major version has its own package: `postgresql<Version>`
**Virtual package** [postgresql](https://community.chocolatey.org/packages/postgresql) also contains all versions that depend on adequate major version, but using it without problems require some special choco parameters.
To propagate package parameters to dependencies use `--params-global` choco install parameter with virtual package `postgresql`. Assuming latest version is 12, to provide password the following two examples result in identical installation:
```sh
choco install postgresql --params '/Password:test' --params-global
choco install postgresql12 --params '/Password:test'
```
To uninstall dependent package use `--force-dependencies`:
```sh
# The following two examples are identical
choco uninstall postgresql --force-dependencies
choco uninstall postgresql12 postgresql
# This example uninstalls only postgresql virtual package and not postgresql12
choco uninstall postgresql
```
To force reinstallation via virtual package use `--force-dependencies`:
```sh
# The following two examples are identical
choco install postgresql --force --force-dependencies
choco install postgresql12 --force --force-dependencies
# This will reinstall only postgresql virtual package and not its dependency postgresql12
choco install postgresql -force
# This one is different then the first one as vcredist140 dependency is not reinstalled
choco install postgresql12 --force
```
**Please Note**: This is an automatically updated package. If you find it is
out of date by more than a day or two, please contact the maintainer(s) and
let them know [here](https://github.com/mkevenaar/chocolatey-packages/issues) that the package is no longer updating correctly.
Chocolatey**PostgreSQL** is a powerful, open-source **object-relational database management system (ORDBMS)**, developed at the **University of California, Berkeley**.
It extends the POSTGRES project and pioneered features later adopted by other commercial systems.
PostgreSQL is **free to use, modify, and distribute** for private, commercial, or academic purposes.
## Features
- See the [Feature Matrix](https://www.postgresql.org/about/featurematrix)
## Package parameters
| Parameter | Description |
|------------|--------------|
| `/AllowRemote` | Enables remote connections (adds entries to `pg_hba.conf`). |
| `/Password` | Sets password for `postgres` user. If omitted, one is generated. Ignored if PostgreSQL already exists. |
| `/Port` | Database server port. Defaults to `5432` or next available port. |
| `/NoPath` | Prevents adding PostgreSQL `bin` directory to `PATH`. |
Other parameters could be set via `--ia` argument, example:
```powershell
choco install postgresql13 --params '/Password:test /Port:5433' --ia '--enable-components server,commandlinetools'
```
Check all [installer](https://www.enterprisedb.com/downloads/postgres-postgresql-downloads) options by adding `--help` as command line argument.
## Notes
- Test installation (specify your password):
`$Env:PGPASSWORD='test'; '\conninfo' | psql -Upostgres`
This should output:
`You are connected to database "postgres" as user "postgres" on host "localhost" at port "5432"`
- This package will install PostgreSQL to `$Env:ProgramFiles\PostgreSQL\[MajorVersion]`.
- If you have problems during installation see [troubleshooting page](https://wiki.postgresql.org/wiki/Troubleshooting_Installation).
- If you didn't specify password during setup and didn't record the generated one, you need manually reset it using the following steps:
- Open file `data\pg_hba.conf` in PostgreSql installation directory
- Change `METHOD` to `trust` and restart service with `Restart-Service postgresql*`
- Execute `"alter user postgres with password '[my password]';" | psql -Upostgres`
- Revert back `data\pg_hba.conf` to METHOD `md5` and restart service
### Virtual package
Each major version has its own package: `postgresql<Version>`
**Virtual package** [postgresql](https://community.chocolatey.org/packages/postgresql) also contains all versions that depend on adequate major version, but using it without problems require some special choco parameters.
To propagate package parameters to dependencies use `--params-global` choco install parameter with virtual package `postgresql`. Assuming latest version is 12, to provide password the following two examples result in identical installation:
```sh
choco install postgresql --params '/Password:test' --params-global
choco install postgresql12 --params '/Password:test'
```
To uninstall dependent package use `--force-dependencies`:
```sh
# The following two examples are identical
choco uninstall postgresql --force-dependencies
choco uninstall postgresql12 postgresql
# This example uninstalls only postgresql virtual package and not postgresql12
choco uninstall postgresql
```
To force reinstallation via virtual package use `--force-dependencies`:
```sh
# The following two examples are identical
choco install postgresql --force --force-dependencies
choco install postgresql12 --force --force-dependencies
# This will reinstall only postgresql virtual package and not its dependency postgresql12
choco install postgresql -force
# This one is different then the first one as vcredist140 dependency is not reinstalled
choco install postgresql12 --force
```
**Please Note**: This is an automatically updated package. If you find it is
out of date by more than a day or two, please contact the maintainer(s) and
let them know [here](https://github.com/mkevenaar/chocolatey-packages/issues) that the package is no longer updating correctly.
NPM
RubyGems
GitHub
Docker Hub