Bug 1954112 (CVE-2021-3515)

Summary:	CVE-2021-3515 pglogical: Shell injection by pglogical users with CREATEDB access
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akarol, dmetzger, gmccullo, gtanzill, jfrey, jhardy, obarenbo, roliveri, security-response-team, simaishi, smallamp
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	pglogical 2.3.4, pglogical 3.6.26	Doc Type:	If docs needed, set a value
Doc Text:	A shell injection flaw was found in pglogical, logical replication extension for PostgreSQL. An attacker with CREATEDB privileges on a PostgreSQL server can craft a database name that allows execution of shell commands as the postgresql user when calling pglogical.create_subscription().	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-17 14:33:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1954113, 1954115

Description Pedro Sampaio 2021-04-27 15:36:35 UTC

A flaw was found in pglogical 2.3.3 and earlier, 3.6.25 and earlier. A user having CREATEDB privilege on a PostgreSQL server can craft a database name that allows execution of shell commands as the postgresql user when calling pglogical.create_subscription().

Comment 1 Yadnyawalk Tale 2021-04-28 11:27:28 UTC

Red Hat CloudForms do not ship pglogical 5.11 onward, thus CFME is not affected to the flaw. The rubygem-pg-pglogical (https://github.com/ManageIQ/pg-pglogical) is different than rh-postgresql95-postgresql-pglogical (https://github.com/2ndQuadrant/pglogical) package.

cloudforms_managementengine:5.10/rh-postgresql95-postgresql-pglogical-2.1.0-4.el7cf
cloudforms_managementengine:5.10/cfme-gemset-0:5.10.15.1-1.el7cf:rubygem-pg-pglogical-2.1.2
cloudforms_managementengine:5.11/cfme-gemset:rubygem-pg-pglogical-2.1.3

Comment 2 Yadnyawalk Tale 2021-04-28 11:27:52 UTC

Acknowledgments:

Name: Pedro Gallegos

Comment 4 Yadnyawalk Tale 2021-05-17 09:45:51 UTC

Official release note: https://github.com/2ndQuadrant/pglogical/commit/086651fcb97de643b02befa838c426c632021f03

Comment 5 Product Security DevOps Team 2021-05-17 14:33:46 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3515