Critical Vulnerability in PostgreSQL: Adminpack Extension ACL Bypass
Summary
ALPINE-CVE-2018-1115: postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. Affects postgresql versions < 10.4-r0. Fixed in 10.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source relational database system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. The adminpack extension provides additional administrative functions, including log file management. However, a vulnerability in this extension allows unauthorized log rotation, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from the pg_catalog.pg_logfile_rotate() function in the adminpack extension, which does not enforce the same Access Control Lists (ACLs) as the pg_rotate_logfile function. This discrepancy allows an attacker with connection access to the database to exploit the vulnerability and force log rotation, potentially leading to unauthorized access to sensitive log data.
How To Fix
Minimum fixed version
10.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the adminpack extension in the affected databases until the package can be updated. This can be done with the following SQL command:
DROP EXTENSION adminpack;
Conclusion
The vulnerability in the PostgreSQL adminpack extension poses a significant security risk due to improper ACL enforcement. It is crucial to update to the patched versions to protect against potential exploits. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for postgresql →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Versions of PostgreSQL prior to 10.4 and 9.6.9 are affected, depending on the Alpine version.
An attacker could exploit this vulnerability to force log rotation, potentially gaining access to sensitive log data.
Yes, you can temporarily disable the adminpack extension in your databases as a workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
