Bug 1221537 – CVE-2015-3165 postgresql: double-free after authentication timeout

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1221537 - (CVE-2015-3165) CVE-2015-3165 postgresql: double-free after authentication timeout

Summary:	CVE-2015-3165 postgresql: double-free after authentication timeout

Status:	CLOSED ERRATA

Aliases:	CVE-2015-3165

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20150522,repor...
Keywords:	Security

Depends On:	1224319 1224320 1225794 1225795 1225797 1225798 1225799 1232680 1232685
Blocks:	1221543
	Show dependency tree / graph

Reported:	2015-05-14 06:12 EDT by Martin Prpič
Modified:	2015-11-25 05:34 EST (History)
CC List:	30 users (show)

See Also:
Fixed In Version:	postgresql 9.4.2, postgresql 9.3.7, postgresql 9.2.11, postgresql 9.1.16, postgresql 9.0.20
Doc Type:	Bug Fix
Doc Text:	A double-free flaw was found in the way PostgreSQL handled connections. An unauthenticated attacker could possibly exploit this flaw to crash the PostgreSQL backend by disconnecting at approximately the same time as the authentication time out was triggered.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-07-10 00:31:40 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:1194	normal	SHIPPED_LIVE	Moderate: postgresql security update	2015-06-29 16:43:24 EDT
Red Hat Product Errata	RHSA-2015:1195	normal	SHIPPED_LIVE	Moderate: postgresql92-postgresql security update	2015-06-29 16:09:47 EDT
Red Hat Product Errata	RHSA-2015:1196	normal	SHIPPED_LIVE	Moderate: rh-postgresql94-postgresql security update	2015-06-29 16:09:05 EDT

Groups: None (edit)

Description Martin Prpič 2015-05-14 06:12:41 EDT

The PostgreSQL project reports the following issue:

If a unauthenticated client disconnects just as the authentication timeout expires, the server will doubly free an allocation. This can crash the server, creating a denial of service. Since that particular server process exchanges no further data with any client, worse consequences are unlikely.

This flaw is fixed in upstream versions 9.4.2, 9.3.7, 9.2.11, 9.1.16, and 9.0.20 of PostgreSQL.

Acknowledgements:

Red Hat would like to thank the PostgreSQL project for reporting this issue. Upstream acknowledges Benkocs Norbert Attila as the original reporter.

Comment 4 Stefan Cornelius 2015-05-22 10:29:15 EDT

Public via:
http://www.postgresql.org/about/news/1587/

Comment 8 Devrim Gündüz 2015-06-03 03:40:35 EDT

Please note that PostgreSQL community is releasing new versions on 4th of July which fixes a critical startup issue, and also there is another release pending next week to fix data corruption issues.

Comment 9 Devrim Gündüz 2015-06-03 03:42:20 EDT

(In reply to Devrim GÜNDÜZ from comment #8)
> Please note that PostgreSQL community is releasing new versions on 4th of
> July which fixes a critical startup issue, and also there is another release
> pending next week to fix data corruption issues.

Sorry, I meant June.

Comment 12 Stefan Cornelius 2015-06-25 09:15:51 EDT

Patch:
http://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=85270ac7a24a50d43ba4bd4d7af1e28b14dee7ee

Comment 13 errata-xmlrpc 2015-06-29 12:09:27 EDT

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6

Via RHSA-2015:1196 https://rhn.redhat.com/errata/RHSA-2015-1196.html

Comment 14 errata-xmlrpc 2015-06-29 12:10:40 EDT

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6

Via RHSA-2015:1195 https://rhn.redhat.com/errata/RHSA-2015-1195.html

Comment 15 errata-xmlrpc 2015-06-29 12:45:20 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2015:1194 https://rhn.redhat.com/errata/RHSA-2015-1194.html

Comment 16 Martin Prpič 2015-07-24 03:10:09 EDT

Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This flaw has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Note You need to log in before you can comment on or make changes to this bug.

apatters
bkearney
cperry
dajohnso
databases-maint
dclarizi
devrim
ggainey
gmccullo
hhorak
jhardy
jmlich
jorton
jprause
jstanek
jvlcek
kseifried
mdshaikh
meissner
mkollar
mmaslano
mprpic
obarenbo
praiskup
security-response-team
taw
tgl
thomas
tjay
xlecauch