{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated EnterpriseDB package that fixes a security issue is now\navailable for Red Hat eXchange.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "EnterpriseDB Advanced Server is a relational database management system\n(RDBMS) based on PostgreSQL.  This product is available for Red Hat\nEnterprise Linux 5 via the Red Hat eXchange (http://rhx.redhat.com) \n\nA flaw was found in handling of certain debugging function calls in \nEnterpriseDB Advanced Server.  A remote authenticated user could send a\ncarefully crafted request and cause a denial of service (daemon crash) or\npossibly execute arbitrary code.  (CVE-2007-4639)\n\nUsers of EnterpriseDB Advanced Server should upgrade to this updated\npackage, which resolves this issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2007:0895",
        "url": "https://access.redhat.com/errata/RHSA-2007:0895"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "284521",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=284521"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0895.json"
      }
    ],
    "title": "Red Hat Security Advisory: EnterpriseDB security update",
    "tracking": {
      "current_release_date": "2025-11-21T17:32:18+00:00",
      "generator": {
        "date": "2025-11-21T17:32:18+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2007:0895",
      "initial_release_date": "2007-09-24T15:58:00+00:00",
      "revision_history": [
        {
          "date": "2007-09-24T15:58:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2007-09-24T11:58:48+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T17:32:18+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHX (v. 5 EnterpriseDB)",
                "product": {
                  "name": "RHX (v. 5 EnterpriseDB)",
                  "product_id": "5Server-RHX-EnterpriseDB",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhx_enterprisedb_advanced_server:7.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Exchange (RHX)"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "EnterpriseDB-0:8.1.9.27-1.i586",
                "product": {
                  "name": "EnterpriseDB-0:8.1.9.27-1.i586",
                  "product_id": "EnterpriseDB-0:8.1.9.27-1.i586",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/EnterpriseDB@8.1.9.27-1?arch=i586"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "EnterpriseDB-0:8.1.9.27-1.i586 as a component of RHX (v. 5 EnterpriseDB)",
          "product_id": "5Server-RHX-EnterpriseDB:EnterpriseDB-0:8.1.9.27-1.i586"
        },
        "product_reference": "EnterpriseDB-0:8.1.9.27-1.i586",
        "relates_to_product_reference": "5Server-RHX-EnterpriseDB"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2007-4639",
      "discovery_date": "2007-08-31T00:00:00+00:00",
      "notes": [
        {
          "category": "description",
          "text": "EnterpriseDB Advanced Server 8.2 does not properly handle certain debugging function calls that occur before a call to pldbg_create_listener, which allows remote authenticated users to cause a denial of service (daemon crash) and possibly execute arbitrary code via a SELECT statement that invokes a pldbg_ function, as demonstrated by (1) pldbg_get_stack and (2) pldbg_abort_target, which triggers use of an uninitialized pointer.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-RHX-EnterpriseDB:EnterpriseDB-0:8.1.9.27-1.i586"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2007-4639"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2007-4639",
          "url": "https://www.cve.org/CVERecord?id=CVE-2007-4639"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-4639",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4639"
        }
      ],
      "release_date": "2007-08-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2007-09-24T15:58:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "5Server-RHX-EnterpriseDB:EnterpriseDB-0:8.1.9.27-1.i586"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2007:0895"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "EnterpriseDB security flaw"
    }
  ]
}