Insecure File Creation Vulnerability in PostgreSQL
Summary
CVE-2018-1053: In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of pg_dumpall -g under umas... Affects postgresql versions < 10.2-r0. Fixed in 10.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an open-source relational database management system known for its robustness, extensibility, and adherence to SQL standards. It is widely used in various applications and industries. However, a vulnerability has been discovered in PostgreSQL versions 9.3.x to 10.x that allows an authenticated attacker to read or modify a file created during the pg_upgrade process. This file may contain sensitive information such as encrypted or unencrypted database passwords.
Vulnerability Detail
The vulnerability (CVE-2018-1053) arises from the fact that pg_upgrade creates a file in the current working directory with the output of pg_dumpall -g. This file is created with the umask that was in effect when the user invoked pg_upgrade, rather than the more secure 0077 umask used for other temporary files. As a result, an attacker with access to the current working directory can potentially access or modify the file, leading to unauthorized disclosure or modification of sensitive information.
How To Fix
Minimum fixed version
10.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually set the umask to 0077 before invoking pg_upgrade. This can be done by running the following command before executing pg_upgrade:
$ umask 0077
By setting the umask explicitly, the file created during pg_upgrade will be protected with the secure 0077 umask, reducing the risk of unauthorized access or modification.
Conclusion
The insecure file creation vulnerability in PostgreSQL versions 9.3.x to 10.x poses a significant risk to the security of sensitive information. It is crucial for users to upgrade to the fixed versions or apply the recommended workaround to mitigate the vulnerability. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for postgresql →
FAQ
The vulnerability allows an authenticated attacker to potentially access or modify a file containing sensitive information, such as database passwords. This can lead to unauthorized disclosure or modification of data, posing a significant security risk.
Users of PostgreSQL versions 9.3.x to 10.x are affected by this vulnerability. It is important for organizations and individuals using these versions to upgrade to the fixed versions to mitigate the risk.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to address the vulnerability promptly to prevent potential attacks.
While upgrading to the fixed versions is the recommended approach, users can apply the workaround of setting the umask to 0077 before running pg_upgrade. This helps protect the file created during the process, reducing the risk of unauthorized access or modification.
For more detailed information about this vulnerability, including technical specifics and affected package versions, refer to the official CVE-2018-1053 entry at the National Vulnerability Database (NVD) or the provided source link.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
