Bug 1378043 (CVE-2016-7048)

Summary:	CVE-2016-7048 postgresql: Interactive installer downloads and executes software via plain HTTP
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bkearney, cpelland, dajohnso, databases-maint, dclarizi, devrim, gblomqui, gmccullo, gtanzill, hhorak, hhudgeon, jfrey, jhardy, jmlich83, jorton, jprause, jrafanie, jstanek, kseifried, obarenbo, pkajaba, pkubat, praiskup, roliveri, security-response-team, simaishi, taw, tgl, tkasparek, tlestach
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-09-21 21:02:35 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1378044

Description Adam Mariš 2016-09-21 11:39:46 UTC

The interactive installer used in EnterpriseDB-supplied PostgreSQL packages failed to secure its connection to the download server. Hence, an attacker able to impersonate the download server within a PostgreSQL installation's network scope can execute arbitrary code, as root, during initial installation or when the user directs the installed StackBuilder to acquire additional software. PostgreSQL binaries delivered other ways, such as installations from Yum or Apt packages, are unaffected.

Comment 1 Adam Mariš 2016-09-21 11:40:03 UTC

Acknowledgments:

Name: the PostgreSQL project