PostgreSQL Vulnerability: Disclosure of Table Contents Due to INSERT ... ON CONFLICT DO UPDATE
Summary
ALPINE-CVE-2017-15099: INSERT ... Affects postgresql versions < 10.1-r0. Fixed in 10.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source relational database management system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. However, certain versions of PostgreSQL are vulnerable to a specific issue where the INSERT ... ON CONFLICT DO UPDATE command can disclose table contents that the invoker lacks the privilege to read. This vulnerability affects users who have INSERT and UPDATE privileges but lack full read access to specific tables.
Vulnerability Detail
The vulnerability, identified as CVE-2017-15099, arises from the way PostgreSQL handles INSERT ... ON CONFLICT DO UPDATE commands in versions 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10. It allows attackers to exploit tables where they lack full read access but possess INSERT and UPDATE privileges. This can lead to unauthorized disclosure of sensitive data, bypassing row-level security policies and the lack of SELECT privileges.
How To Fix
Minimum fixed version
10.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting INSERT and UPDATE privileges on sensitive tables for users who do not require them. This can be done using the following SQL command:
REVOKE INSERT, UPDATE ON table_name FROM user_name;
Conclusion
In summary, the CVE-2017-15099 vulnerability in PostgreSQL can lead to unauthorized disclosure of sensitive data due to improper handling of INSERT ... ON CONFLICT DO UPDATE commands. It is crucial to update to the latest patched versions to mitigate this risk and consider implementing workarounds if immediate updates are not feasible.
See every vulnerability recorded for postgresql →
FAQ
The vulnerability affects PostgreSQL versions 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10.
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider implementing the suggested workaround by revoking unnecessary privileges from users.
You can visit the official PostgreSQL website or security advisories for detailed information on vulnerabilities and their fixes.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
