Amazon Linux AMI update for postgresql92

Published: 2021-07-13

Risk	Medium
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2019-10208 CVE-2020-25694 CVE-2020-25695
CWE-ID	CWE-264 CWE-284 CWE-89
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Amazon Linux AMI Operating systems & Components / Operating system
Vendor	Amazon Web Services

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU20003

Risk: Low

CVSSv3.1: 3.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-10208

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to way PostreSQL processes SECURITY DEFINER functions. A privileged attacker with EXECUTE permission, which must itself contain a function call having inexact argument type match, can execute arbitrary SQL query under the identity of the function owner.

Mitigation

Update the affected packages:

i686:
    postgresql92-pltcl-9.2.24-3.67.amzn1.i686
    postgresql92-plperl-9.2.24-3.67.amzn1.i686
    postgresql92-devel-9.2.24-3.67.amzn1.i686
    postgresql92-debuginfo-9.2.24-3.67.amzn1.i686
    postgresql92-contrib-9.2.24-3.67.amzn1.i686
    postgresql92-server-compat-9.2.24-3.67.amzn1.i686
    postgresql92-test-9.2.24-3.67.amzn1.i686
    postgresql92-docs-9.2.24-3.67.amzn1.i686
    postgresql92-9.2.24-3.67.amzn1.i686
    postgresql92-libs-9.2.24-3.67.amzn1.i686
    postgresql92-plpython27-9.2.24-3.67.amzn1.i686
    postgresql92-server-9.2.24-3.67.amzn1.i686
    postgresql92-plpython26-9.2.24-3.67.amzn1.i686

src:
    postgresql92-9.2.24-3.67.amzn1.src

x86_64:
    postgresql92-9.2.24-3.67.amzn1.x86_64
    postgresql92-libs-9.2.24-3.67.amzn1.x86_64
    postgresql92-debuginfo-9.2.24-3.67.amzn1.x86_64
    postgresql92-contrib-9.2.24-3.67.amzn1.x86_64
    postgresql92-docs-9.2.24-3.67.amzn1.x86_64
    postgresql92-test-9.2.24-3.67.amzn1.x86_64
    postgresql92-plpython26-9.2.24-3.67.amzn1.x86_64
    postgresql92-pltcl-9.2.24-3.67.amzn1.x86_64
    postgresql92-plperl-9.2.24-3.67.amzn1.x86_64
    postgresql92-server-9.2.24-3.67.amzn1.x86_64
    postgresql92-plpython27-9.2.24-3.67.amzn1.x86_64
    postgresql92-server-compat-9.2.24-3.67.amzn1.x86_64
    postgresql92-devel-9.2.24-3.67.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2021-1519.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU48437

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-25694

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can perform a man-in-the-middle attack or observe clear-text transmissions and downgrade connection security settings.

Mitigation

Update the affected packages:

i686:
    postgresql92-pltcl-9.2.24-3.67.amzn1.i686
    postgresql92-plperl-9.2.24-3.67.amzn1.i686
    postgresql92-devel-9.2.24-3.67.amzn1.i686
    postgresql92-debuginfo-9.2.24-3.67.amzn1.i686
    postgresql92-contrib-9.2.24-3.67.amzn1.i686
    postgresql92-server-compat-9.2.24-3.67.amzn1.i686
    postgresql92-test-9.2.24-3.67.amzn1.i686
    postgresql92-docs-9.2.24-3.67.amzn1.i686
    postgresql92-9.2.24-3.67.amzn1.i686
    postgresql92-libs-9.2.24-3.67.amzn1.i686
    postgresql92-plpython27-9.2.24-3.67.amzn1.i686
    postgresql92-server-9.2.24-3.67.amzn1.i686
    postgresql92-plpython26-9.2.24-3.67.amzn1.i686

src:
    postgresql92-9.2.24-3.67.amzn1.src

x86_64:
    postgresql92-9.2.24-3.67.amzn1.x86_64
    postgresql92-libs-9.2.24-3.67.amzn1.x86_64
    postgresql92-debuginfo-9.2.24-3.67.amzn1.x86_64
    postgresql92-contrib-9.2.24-3.67.amzn1.x86_64
    postgresql92-docs-9.2.24-3.67.amzn1.x86_64
    postgresql92-test-9.2.24-3.67.amzn1.x86_64
    postgresql92-plpython26-9.2.24-3.67.amzn1.x86_64
    postgresql92-pltcl-9.2.24-3.67.amzn1.x86_64
    postgresql92-plperl-9.2.24-3.67.amzn1.x86_64
    postgresql92-server-9.2.24-3.67.amzn1.x86_64
    postgresql92-plpython27-9.2.24-3.67.amzn1.x86_64
    postgresql92-server-compat-9.2.24-3.67.amzn1.x86_64
    postgresql92-devel-9.2.24-3.67.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2021-1519.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) SQL injection

EUVDB-ID: #VU48436

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-25695

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote authenticated attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Update the affected packages:

i686:
    postgresql92-pltcl-9.2.24-3.67.amzn1.i686
    postgresql92-plperl-9.2.24-3.67.amzn1.i686
    postgresql92-devel-9.2.24-3.67.amzn1.i686
    postgresql92-debuginfo-9.2.24-3.67.amzn1.i686
    postgresql92-contrib-9.2.24-3.67.amzn1.i686
    postgresql92-server-compat-9.2.24-3.67.amzn1.i686
    postgresql92-test-9.2.24-3.67.amzn1.i686
    postgresql92-docs-9.2.24-3.67.amzn1.i686
    postgresql92-9.2.24-3.67.amzn1.i686
    postgresql92-libs-9.2.24-3.67.amzn1.i686
    postgresql92-plpython27-9.2.24-3.67.amzn1.i686
    postgresql92-server-9.2.24-3.67.amzn1.i686
    postgresql92-plpython26-9.2.24-3.67.amzn1.i686

src:
    postgresql92-9.2.24-3.67.amzn1.src

x86_64:
    postgresql92-9.2.24-3.67.amzn1.x86_64
    postgresql92-libs-9.2.24-3.67.amzn1.x86_64
    postgresql92-debuginfo-9.2.24-3.67.amzn1.x86_64
    postgresql92-contrib-9.2.24-3.67.amzn1.x86_64
    postgresql92-docs-9.2.24-3.67.amzn1.x86_64
    postgresql92-test-9.2.24-3.67.amzn1.x86_64
    postgresql92-plpython26-9.2.24-3.67.amzn1.x86_64
    postgresql92-pltcl-9.2.24-3.67.amzn1.x86_64
    postgresql92-plperl-9.2.24-3.67.amzn1.x86_64
    postgresql92-server-9.2.24-3.67.amzn1.x86_64
    postgresql92-plpython27-9.2.24-3.67.amzn1.x86_64
    postgresql92-server-compat-9.2.24-3.67.amzn1.x86_64
    postgresql92-devel-9.2.24-3.67.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2021-1519.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.