Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

PostgreSQL on Red Hat may let attackers view data

published 3 months ago

Summary

The PostgreSQL packages for Red Hat (including the main server, contrib modules, debug info, development files, and documentation) contain a flaw that could let an attacker read data they should not see. This could expose sensitive business information. Apply the latest Red Hat update for PostgreSQL as soon as possible to close the gap.

What to do

Update redhat postgresql to version 0:9.2.24-9.el7_9.6.
Update redhat postgresql-contrib to version 0:9.2.24-9.el7_9.6.
Update redhat postgresql-debuginfo to version 0:9.2.24-9.el7_9.6.
Update redhat postgresql-devel to version 0:9.2.24-9.el7_9.6.
Update redhat postgresql-docs to version 0:9.2.24-9.el7_9.6.
Update redhat postgresql-libs to version 0:9.2.24-9.el7_9.6.
Update redhat postgresql-plperl to version 0:9.2.24-9.el7_9.6.
Update redhat postgresql-plpython to version 0:9.2.24-9.el7_9.6.
Update redhat postgresql-pltcl to version 0:9.2.24-9.el7_9.6.
Update redhat postgresql-server to version 0:9.2.24-9.el7_9.6.
Update redhat postgresql-test to version 0:9.2.24-9.el7_9.6.
Update redhat postgresql-static to version 0:9.2.24-9.el7_9.6.
Update redhat postgresql-upgrade to version 0:9.2.24-9.el7_9.6.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_els:7	redhat	postgresql	< 0:9.2.24-9.el7_9.6 Fix: upgrade to 0:9.2.24-9.el7_9.6
Red Hat:rhel_els:7	redhat	postgresql-contrib	< 0:9.2.24-9.el7_9.6 Fix: upgrade to 0:9.2.24-9.el7_9.6
Red Hat:rhel_els:7	redhat	postgresql-debuginfo	< 0:9.2.24-9.el7_9.6 Fix: upgrade to 0:9.2.24-9.el7_9.6
Red Hat:rhel_els:7	redhat	postgresql-devel	< 0:9.2.24-9.el7_9.6 Fix: upgrade to 0:9.2.24-9.el7_9.6
Red Hat:rhel_els:7	redhat	postgresql-docs	< 0:9.2.24-9.el7_9.6 Fix: upgrade to 0:9.2.24-9.el7_9.6
Red Hat:rhel_els:7	redhat	postgresql-libs	< 0:9.2.24-9.el7_9.6 Fix: upgrade to 0:9.2.24-9.el7_9.6
Red Hat:rhel_els:7	redhat	postgresql-plperl	< 0:9.2.24-9.el7_9.6 Fix: upgrade to 0:9.2.24-9.el7_9.6
Red Hat:rhel_els:7	redhat	postgresql-plpython	< 0:9.2.24-9.el7_9.6 Fix: upgrade to 0:9.2.24-9.el7_9.6
Red Hat:rhel_els:7	redhat	postgresql-pltcl	< 0:9.2.24-9.el7_9.6 Fix: upgrade to 0:9.2.24-9.el7_9.6
Red Hat:rhel_els:7	redhat	postgresql-server	< 0:9.2.24-9.el7_9.6 Fix: upgrade to 0:9.2.24-9.el7_9.6
Red Hat:rhel_els:7	redhat	postgresql-test	< 0:9.2.24-9.el7_9.6 Fix: upgrade to 0:9.2.24-9.el7_9.6
Red Hat:rhel_els:7	redhat	postgresql-static	< 0:9.2.24-9.el7_9.6 Fix: upgrade to 0:9.2.24-9.el7_9.6
Red Hat:rhel_els:7	redhat	postgresql-upgrade	< 0:9.2.24-9.el7_9.6 Fix: upgrade to 0:9.2.24-9.el7_9.6

Original advisory text

Red Hat Security Advisory: postgresql security update

References

https://access.redhat.com/errata/RHSA-2026:49521 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2477442 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2477443 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2477447 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2477448 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49521.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-6473 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-6473 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6473 Vendor Advisory
https://www.postgresql.org/support/security/CVE-2026-6473/ Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-6477 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-6477 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6477 Vendor Advisory
https://www.postgresql.org/support/security/CVE-2026-6477/ Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-6478 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-6478 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6478 Vendor Advisory
https://www.postgresql.org/support/security/CVE-2026-6478/ Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-6637 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-6637 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6637 Vendor Advisory
https://www.postgresql.org/support/security/CVE-2026-6637/ Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Timeline

Published4 Aug 2026

Updated1 Oct 2026

First seen1 Oct 2026

Sources

RHSA-2026:49521 · OSV

Track software like this

Free during beta