Bug 1260567 (CVE-2015-6817)

Summary:	CVE-2015-6817 pgbouncer: failed auth_query lookup leads to connection as auth_user
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	devrim
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	pgbouncer 1.6.1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-09-07 09:28:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Martin Prpič 2015-09-07 09:27:18 UTC

The following flaw was found in PgBouncer:

New auth_user functionality introduced in 1.6 allows login as auth_user when client presents unknown username. It’s quite likely auth_user is superuser. Affects only setups that have enabled auth_user in their config.

Upstream issue:

http://comments.gmane.org/gmane.comp.db.postgresql.pgbouncer.general/1251

Upstream patch:

https://github.com/pgbouncer/pgbouncer/commit/7ca3e5279d05fceb1e8a043c6f5b6f58dea3ed38

External References:

https://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/

Comment 1 Martin Prpič 2015-09-07 09:28:10 UTC

The auth_user functionality was introduced in version 1.6. Fedora ships versions 1.5.x and is thus not affected.