openEuler 22.03 LTS SP4 update for postgresql



Risk High
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2024-10976
CVE-2024-10977
CVE-2024-10978
CVE-2024-10979
CVE-2023-2455
CVE-2016-2193
CWE-ID CWE-269
CWE-300
CWE-266
CWE-285
CWE-254
Exploitation vector Network
Public exploit N/A
Vulnerable software
 openEuler
Operating systems & Components / Operating system

postgresql-test-rpm-macros
Operating systems & Components / Operating system package or component

postgresql-test
Operating systems & Components / Operating system package or component

postgresql-static
Operating systems & Components / Operating system package or component

postgresql-server-devel
Operating systems & Components / Operating system package or component

postgresql-server
Operating systems & Components / Operating system package or component

postgresql-private-libs
Operating systems & Components / Operating system package or component

postgresql-private-devel
Operating systems & Components / Operating system package or component

postgresql-pltcl
Operating systems & Components / Operating system package or component

postgresql-plpython3
Operating systems & Components / Operating system package or component

postgresql-plperl
Operating systems & Components / Operating system package or component

postgresql-llvmjit
Operating systems & Components / Operating system package or component

postgresql-docs
Operating systems & Components / Operating system package or component

postgresql-debugsource
Operating systems & Components / Operating system package or component

postgresql-debuginfo
Operating systems & Components / Operating system package or component

postgresql-contrib
Operating systems & Components / Operating system package or component

postgresql
Operating systems & Components / Operating system package or component

Vendor openEuler

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Improper privilege management

EUVDB-ID: #VU100511

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-10976

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to improper privilege management in cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. A remote user can bypass implemented security restrictions and gain unauthorized access to the database in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP4

postgresql-test-rpm-macros: before 13.17-1

postgresql-test: before 13.17-1

postgresql-static: before 13.17-1

postgresql-server-devel: before 13.17-1

postgresql-server: before 13.17-1

postgresql-private-libs: before 13.17-1

postgresql-private-devel: before 13.17-1

postgresql-pltcl: before 13.17-1

postgresql-plpython3: before 13.17-1

postgresql-plperl: before 13.17-1

postgresql-llvmjit: before 13.17-1

postgresql-docs: before 13.17-1

postgresql-debugsource: before 13.17-1

postgresql-debuginfo: before 13.17-1

postgresql-contrib: before 13.17-1

postgresql: before 13.17-1

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2467


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Man-in-the-Middle (MitM) attack

EUVDB-ID: #VU100512

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-10977

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

Description

The vulnerability allows a remote attacker to spoof error messages from the database.

The vulnerability exists due to an error in libpq, which allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. A remote attacker can perform a man-in-the-middle attack to send a long error message that a human or screen-scraper user of psql mistakes for valid query results.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP4

postgresql-test-rpm-macros: before 13.17-1

postgresql-test: before 13.17-1

postgresql-static: before 13.17-1

postgresql-server-devel: before 13.17-1

postgresql-server: before 13.17-1

postgresql-private-libs: before 13.17-1

postgresql-private-devel: before 13.17-1

postgresql-pltcl: before 13.17-1

postgresql-plpython3: before 13.17-1

postgresql-plperl: before 13.17-1

postgresql-llvmjit: before 13.17-1

postgresql-docs: before 13.17-1

postgresql-debugsource: before 13.17-1

postgresql-debuginfo: before 13.17-1

postgresql-contrib: before 13.17-1

postgresql: before 13.17-1

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2467


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Incorrect privilege assignment

EUVDB-ID: #VU100513

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-10978

CWE-ID: CWE-266 - Incorrect Privilege Assignment

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to incorrect privilege assignment when application uses SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. A remote user can force the application to reset their role to a wrong user ID and view or change different rows from those intended.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP4

postgresql-test-rpm-macros: before 13.17-1

postgresql-test: before 13.17-1

postgresql-static: before 13.17-1

postgresql-server-devel: before 13.17-1

postgresql-server: before 13.17-1

postgresql-private-libs: before 13.17-1

postgresql-private-devel: before 13.17-1

postgresql-pltcl: before 13.17-1

postgresql-plpython3: before 13.17-1

postgresql-plperl: before 13.17-1

postgresql-llvmjit: before 13.17-1

postgresql-docs: before 13.17-1

postgresql-debugsource: before 13.17-1

postgresql-debuginfo: before 13.17-1

postgresql-contrib: before 13.17-1

postgresql: before 13.17-1

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2467


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper authorization

EUVDB-ID: #VU100514

Risk: High

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-10979

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to incorrect control of environment variables. A remote unprivileged database user can change sensitive process environment variables (e.g. PATH) and execute arbitrary code on the database server.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP4

postgresql-test-rpm-macros: before 13.17-1

postgresql-test: before 13.17-1

postgresql-static: before 13.17-1

postgresql-server-devel: before 13.17-1

postgresql-server: before 13.17-1

postgresql-private-libs: before 13.17-1

postgresql-private-devel: before 13.17-1

postgresql-pltcl: before 13.17-1

postgresql-plpython3: before 13.17-1

postgresql-plperl: before 13.17-1

postgresql-llvmjit: before 13.17-1

postgresql-docs: before 13.17-1

postgresql-debugsource: before 13.17-1

postgresql-debuginfo: before 13.17-1

postgresql-contrib: before 13.17-1

postgresql: before 13.17-1

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2467


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Security features bypass

EUVDB-ID: #VU76042

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-2455

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to incomplete fix for #VU40402 (CVE-2016-2193) that did not anticipate a scenario involving function inlining. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications.

This affects only databases that have used CREATE POLICY to define a row security policy.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP4

postgresql-test-rpm-macros: before 13.17-1

postgresql-test: before 13.17-1

postgresql-static: before 13.17-1

postgresql-server-devel: before 13.17-1

postgresql-server: before 13.17-1

postgresql-private-libs: before 13.17-1

postgresql-private-devel: before 13.17-1

postgresql-pltcl: before 13.17-1

postgresql-plpython3: before 13.17-1

postgresql-plperl: before 13.17-1

postgresql-llvmjit: before 13.17-1

postgresql-docs: before 13.17-1

postgresql-debugsource: before 13.17-1

postgresql-debuginfo: before 13.17-1

postgresql-contrib: before 13.17-1

postgresql: before 13.17-1

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2467


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Security Features

EUVDB-ID: #VU40402

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-2193

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass intended access restrictions by leveraging a session that performs queries as more than one role.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP4

postgresql-test-rpm-macros: before 13.17-1

postgresql-test: before 13.17-1

postgresql-static: before 13.17-1

postgresql-server-devel: before 13.17-1

postgresql-server: before 13.17-1

postgresql-private-libs: before 13.17-1

postgresql-private-devel: before 13.17-1

postgresql-pltcl: before 13.17-1

postgresql-plpython3: before 13.17-1

postgresql-plperl: before 13.17-1

postgresql-llvmjit: before 13.17-1

postgresql-docs: before 13.17-1

postgresql-debugsource: before 13.17-1

postgresql-debuginfo: before 13.17-1

postgresql-contrib: before 13.17-1

postgresql: before 13.17-1

CPE2.3 External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2467


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###