Bug 1477187 (CVE-2017-7548)

Summary:	CVE-2017-7548 postgresql: lo_put() function ignores ACLs
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bkearney, cpelland, dajohnso, databases-maint, devrim, gblomqui, ggainey, gmccullo, gtanzill, hhorak, hhudgeon, jfrey, jhardy, jmlich83, jorton, jprause, jstanek, kbost, meissner, mike, obarenbo, pkubat, praiskup, roliveri, security-response-team, simaishi, tgl, thomas, tlestach
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	postgresql 9.4.13, postgresql 9.5.8, postgresql 9.6.4	Doc Type:	If docs needed, set a value
Doc Text:	An authorization flaw was found in the way PostgreSQL handled large objects. A remote, authenticated attacker with no privileges on a large object could potentially use this flaw to overwrite the entire content of the object, thus resulting in denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:19:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1480283, 1480284, 1484632, 1484633, 1484634, 1484635, 1484636, 1484637
Bug Blocks:	1477189

Description Adam Mariš 2017-08-01 12:34:50 UTC

Users with no privilege on a large object can overwrite the entire content of the object.

Supported vulnerable versions: 9.4 - 9.6

Upstream patch:

https://github.com/postgres/postgres/commit/f1cda6d6cbb2

Bug introduced in:

https://github.com/postgres/postgres/commit/c50b7c09d852b6d

The first affected upstream version is 9.4.

Comment 1 Adam Mariš 2017-08-01 12:35:00 UTC

Acknowledgments:

Name: the PostgreSQL project
Upstream: Chapman Flack

Comment 2 Adam Mariš 2017-08-10 15:09:06 UTC

External References:

https://www.postgresql.org/about/news/1772/

Comment 3 Adam Mariš 2017-08-10 15:12:42 UTC

Created mingw-postgresql tracking bugs for this issue:

Affects: fedora-all [bug 1480283]


Created postgresql tracking bugs for this issue:

Affects: fedora-all [bug 1480284]

Comment 8 errata-xmlrpc 2017-09-12 08:01:48 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2017:2677 https://access.redhat.com/errata/RHSA-2017:2677

Comment 9 errata-xmlrpc 2017-09-12 10:04:03 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2017:2678 https://access.redhat.com/errata/RHSA-2017:2678