Red Hat Security Advisory 2012-0678-01

newsbot

newsbot

RSS Feed
Red Hat Security Advisory 2012-0678-01 - PostgreSQL is an advanced object-relational database management system. The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by an SQL command. This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation. When configured to do SSL certificate verification, PostgreSQL only checked the first 31 characters of the certificate's Common Name field. Depending on the configuration, this could allow an attacker to impersonate a server or a client using a certificate from a trusted Certificate Authority issued for a different name.

Weiterlesen...
 

Ähnliche Themen

Red Hat Security Advisory 2012-0677-01

Red Hat Security Advisory 2012-1263-01

Red Hat Security Advisory 2012-1264-01

Red Hat Security Advisory 2012-1550-01

Red Hat Security Advisory 2013-0155-01

Zurück
Oben