openEuler 20.03 LTS update for postgresql

Published: 2020-09-30

Risk	Medium
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2020-14349 CVE-2020-14350 CVE-2018-1058
CWE-ID	CWE-426 CWE-427
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	openEuler Operating systems & Components / Operating system postgresql-test-rpm-macros Operating systems & Components / Operating system package or component postgresql-test Operating systems & Components / Operating system package or component postgresql-static Operating systems & Components / Operating system package or component postgresql-server Operating systems & Components / Operating system package or component postgresql-pltcl Operating systems & Components / Operating system package or component postgresql-plpython3 Operating systems & Components / Operating system package or component postgresql-plperl Operating systems & Components / Operating system package or component postgresql-libs Operating systems & Components / Operating system package or component postgresql-help Operating systems & Components / Operating system package or component postgresql-devel Operating systems & Components / Operating system package or component postgresql-debugsource Operating systems & Components / Operating system package or component postgresql-debuginfo Operating systems & Components / Operating system package or component postgresql-contrib Operating systems & Components / Operating system package or component postgresql Operating systems & Components / Operating system package or component
Vendor	openEuler

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Untrusted search path

EUVDB-ID: #VU45748

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-14349

CWE-ID: CWE-426 - Untrusted Search Path

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges within the database.

The vulnerability exists due to the way PostgreSQL handles search_path during replications. Users of a replication publisher or subscriber database can create objects in the public schema and harness them to execute arbitrary SQL functions under the identity running replication, often a superuser.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS

postgresql-test-rpm-macros: before 10.5-18

postgresql-test: before 10.5-18

postgresql-static: before 10.5-18

postgresql-server: before 10.5-18

postgresql-pltcl: before 10.5-18

postgresql-plpython3: before 10.5-18

postgresql-plperl: before 10.5-18

postgresql-libs: before 10.5-18

postgresql-help: before 10.5-18

postgresql-devel: before 10.5-18

postgresql-debugsource: before 10.5-18

postgresql-debuginfo: before 10.5-18

postgresql-contrib: before 10.5-18

postgresql: before 10.5-18

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2020-1067

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Untrusted search path

EUVDB-ID: #VU45749

Risk: Medium

CVSSv3.1: 4.1 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-14350

CWE-ID: CWE-426 - Untrusted Search Path

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges within the database.

The vulnerability exists due to the way PostgreSQL handles CREATE EXTENSION statements. A remote user with permission to create objects in the new extension's schema or a schema of a prerequisite extension can execute arbitrary SQL functions under the identity of the superuser in certain cases.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS

postgresql-test-rpm-macros: before 10.5-18

postgresql-test: before 10.5-18

postgresql-static: before 10.5-18

postgresql-server: before 10.5-18

postgresql-pltcl: before 10.5-18

postgresql-plpython3: before 10.5-18

postgresql-plperl: before 10.5-18

postgresql-libs: before 10.5-18

postgresql-help: before 10.5-18

postgresql-devel: before 10.5-18

postgresql-debugsource: before 10.5-18

postgresql-debuginfo: before 10.5-18

postgresql-contrib: before 10.5-18

postgresql: before 10.5-18

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2020-1067

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Privilege escalation

EUVDB-ID: #VU10810

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1058

CWE-ID: CWE-427 - Uncontrolled Search Path Element

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in the pg_dump function due to improper security restrictions. A local attacker can submit a malicious function in separate namespaces and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS

postgresql-test-rpm-macros: before 10.5-18

postgresql-test: before 10.5-18

postgresql-static: before 10.5-18

postgresql-server: before 10.5-18

postgresql-pltcl: before 10.5-18

postgresql-plpython3: before 10.5-18

postgresql-plperl: before 10.5-18

postgresql-libs: before 10.5-18

postgresql-help: before 10.5-18

postgresql-devel: before 10.5-18

postgresql-debugsource: before 10.5-18

postgresql-debuginfo: before 10.5-18

postgresql-contrib: before 10.5-18

postgresql: before 10.5-18

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2020-1067

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.