Bug 1065219 (CVE-2014-0060)

Summary:	CVE-2014-0060 postgresql: SET ROLE without ADMIN OPTION allows adding and removing group members
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dajohnso, gmollett, praiskup, security-response-team, xlecauch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-20 10:42:58 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1065839, 1065840, 1065841, 1065842, 1065843, 1065844, 1065845, 1065855, 1065861, 1069071, 1069072
Bug Blocks:	1065240, 1095075

Description Murray McAllister 2014-02-14 07:06:36 UTC

Previously, granting an SQL role without ADMIN OPTION allowed the grantee to remove other users from the granted role.

Acknowledgements:

Red Hat would like to thank the PostgreSQL project for reporting this issue. Upstream acknowledges Noah Misch as the original reporter.

Comment 6 Vincent Danen 2014-02-18 23:24:24 UTC

This is now public:

https://github.com/postgres/postgres/commit/fea164a72a7bfd50d77ba5fb418d357f8f2bb7d0

Comment 9 errata-xmlrpc 2014-02-25 16:44:01 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2014:0211 https://rhn.redhat.com/errata/RHSA-2014-0211.html

Comment 10 errata-xmlrpc 2014-02-27 18:23:23 UTC

This issue has been addressed in following products:

  Red Hat Software Collections for RHEL-6

Via RHSA-2014:0221 https://rhn.redhat.com/errata/RHSA-2014-0221.html

Comment 11 errata-xmlrpc 2014-03-04 19:11:24 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2014:0249 https://rhn.redhat.com/errata/RHSA-2014-0249.html

Comment 13 errata-xmlrpc 2014-05-12 18:13:29 UTC

This issue has been addressed in following products:

  CloudForms Management Engine 5.x

Via RHSA-2014:0469 https://rhn.redhat.com/errata/RHSA-2014-0469.html