PostgreSQL Vulnerability: Insecure File Creation in pg_upgrade
Summary
ALPINE-CVE-2018-1053: In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of pg_dumpall -g under umas... Affects postgresql versions < 10.2-r0. Fixed in 10.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source relational database management system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. However, certain versions of PostgreSQL are vulnerable to a security issue where the pg_upgrade utility creates files in the current working directory with improper permissions, potentially exposing sensitive information.
Vulnerability Detail
In PostgreSQL versions 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7, and 10.x before 10.2, the pg_upgrade tool creates a file in the current working directory containing the output of 'pg_dumpall -g' with the prevailing umask instead of the secure 0077. This can allow an authenticated attacker to read or modify the file, which may contain sensitive database passwords, leading to unauthorized access or data breaches.
How To Fix
Minimum fixed version
10.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the current working directory has restrictive permissions that prevent unauthorized access. Additionally, avoid running pg_upgrade in directories where sensitive information may be exposed.
Conclusion
The PostgreSQL vulnerability related to insecure file creation in pg_upgrade poses significant risks to database security. It is crucial for users to update their PostgreSQL installations to the latest versions to mitigate these risks and protect sensitive data.
See every vulnerability recorded for postgresql →
FAQ
Versions 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7, and 10.x before 10.2 are affected.
The CVSS score of this vulnerability is 7.0, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive information, such as database passwords, which could lead to data breaches or unauthorized modifications.
Yes, the permanent fix is to update PostgreSQL to the latest patched version as specified in the 'how to fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
