Permissions, Privileges, and Access Controls in postgresql (Alpine package)



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2019-10208
CWE-ID CWE-264
Exploitation vector Network
Public exploit N/A
Vulnerable software
 postgresql (Alpine package)
Operating systems & Components / Operating system package or component

Vendor Alpine Linux Development Team

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU20003

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-10208

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to way PostreSQL processes SECURITY DEFINER functions. A privileged attacker with EXECUTE permission, which must itself contain a function call having inexact argument type match, can execute arbitrary SQL query under the identity of the function owner.

Mitigation

Install update from vendor's website.

Vulnerable software versions

postgresql (Alpine package): 9.4.4-r0 - 11.4-r0

postgresql (Alpine package):

CPE2.3 External links

https://git.alpinelinux.org/aports/commit/?id=2b95c8929982c3ff86b48ffe921cf9ddff6aeebd
https://git.alpinelinux.org/aports/commit/?id=5f580c412de14f7329bf77293a1c8bbce8a74d48
https://git.alpinelinux.org/aports/commit/?id=9f9b64e2d2abab3c9e46f899aa2633db6ba12ece
https://git.alpinelinux.org/aports/commit/?id=ea5be313d97682dce48ab78c70818867579099d8
https://git.alpinelinux.org/aports/commit/?id=25f75434661e66fa9c230b7c12d6c9b64f356109
https://git.alpinelinux.org/aports/commit/?id=89778c626effbec81e49cb0dabf996bc58469ec2
https://git.alpinelinux.org/aports/commit/?id=50bddd883b32a1297dccbae70ca9740bc193b9ea


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###