Bug 1894430 (CVE-2020-25696) - CVE-2020-25696 postgresql: psql's \gset allows overwriting specially treated variables
Summary: CVE-2020-25696 postgresql: psql's \gset allows overwriting specially treated ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-25696
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1897218 1897224 1897230 1897233 1910648 1897221 1897227 1898243 1898244 1898245 1898246 1898247 1898248 1901555 1901556 1901558 1901559 1901561 1901562 1901563 1901564 1901565 1901566 1901567 1901568 1901569 1901570
Blocks: 1894439
TreeView+ depends on / blocked
 
Reported: 2020-11-04 09:20 UTC by Michael Kaplan
Modified: 2021-07-27 08:27 UTC (History)
80 users (show)

Fixed In Version: postgresql 13.1, postgresql 12.5, postgresql 11.10, postgresql 10.15, postgresql 9.6.20, postgresql 9.5.24
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the psql interactive terminal of PostgreSQL. If an interactive psql session uses \gset when querying a compromised server, this flaw allows an attacker to execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Clone Of:
Environment:
Last Closed: 2020-12-02 17:33:57 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2020:5643 0 None None None 2020-12-21 12:05:01 UTC
Red Hat Product Errata RHBA-2021:0085 0 None None None 2021-01-12 21:43:24 UTC
Red Hat Product Errata RHSA-2020:5316 0 None None None 2020-12-02 10:36:32 UTC
Red Hat Product Errata RHSA-2020:5317 0 None None None 2020-12-02 10:40:06 UTC
Red Hat Product Errata RHSA-2020:5401 0 None None None 2020-12-14 12:55:47 UTC
Red Hat Product Errata RHSA-2020:5567 0 None None None 2020-12-16 08:25:37 UTC
Red Hat Product Errata RHSA-2020:5619 0 None None None 2020-12-17 15:53:19 UTC
Red Hat Product Errata RHSA-2020:5620 0 None None None 2020-12-17 15:58:19 UTC
Red Hat Product Errata RHSA-2020:5638 0 None None None 2020-12-21 10:10:05 UTC
Red Hat Product Errata RHSA-2020:5661 0 None None None 2020-12-22 08:53:29 UTC
Red Hat Product Errata RHSA-2020:5664 0 None None None 2020-12-22 09:27:43 UTC
Red Hat Product Errata RHSA-2021:0057 0 None None None 2021-01-11 10:54:27 UTC
Red Hat Product Errata RHSA-2021:0161 0 None None None 2021-01-18 09:57:57 UTC
Red Hat Product Errata RHSA-2021:0163 0 None None None 2021-01-18 09:59:00 UTC
Red Hat Product Errata RHSA-2021:0164 0 None None None 2021-01-18 10:00:53 UTC
Red Hat Product Errata RHSA-2021:0165 0 None None None 2021-01-18 16:15:15 UTC
Red Hat Product Errata RHSA-2021:0166 0 None None None 2021-01-18 16:19:47 UTC
Red Hat Product Errata RHSA-2021:0167 0 None None None 2021-01-18 16:21:27 UTC

Description Michael Kaplan 2020-11-04 09:20:15 UTC
The \gset meta-command, which sets psql variables based on query results, does
not distinguish variables that control psql behavior.  If an interactive psql
session uses \gset when querying a compromised server, the attacker can
execute arbitrary code as the operating system account running psql.  Using
\gset with a prefix not found among specially treated variables, e.g. any
lowercase string, precludes the attack in an unpatched psql.

Comment 1 Michael Kaplan 2020-11-04 09:20:30 UTC
Acknowledgments:

Name: Nick Cleaton

Comment 8 msiddiqu 2020-11-12 15:19:29 UTC
Created mingw-postgresql tracking bugs for this issue:

Affects: fedora-all [bug 1897233]


Created postgresql tracking bugs for this issue:

Affects: fedora-all [bug 1897230]


Created postgresql:10/postgresql tracking bugs for this issue:

Affects: fedora-all [bug 1897227]


Created postgresql:11/postgresql tracking bugs for this issue:

Affects: fedora-all [bug 1897224]


Created postgresql:12/postgresql tracking bugs for this issue:

Affects: fedora-all [bug 1897221]


Created postgresql:9.6/postgresql tracking bugs for this issue:

Affects: fedora-all [bug 1897218]

Comment 11 Mauro Matteo Cascella 2020-11-17 08:17:47 UTC
External References:

https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/

Comment 12 Mauro Matteo Cascella 2020-11-17 08:48:04 UTC
Mitigation:

Using \gset with a prefix not found among specially treated variables, e.g. any lowercase string, precludes the attack in an unpatched psql.

Comment 16 errata-xmlrpc 2020-12-02 10:36:27 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2020:5316 https://access.redhat.com/errata/RHSA-2020:5316

Comment 17 errata-xmlrpc 2020-12-02 10:39:58 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2020:5317 https://access.redhat.com/errata/RHSA-2020:5317

Comment 18 Product Security DevOps Team 2020-12-02 17:33:57 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-25696

Comment 19 errata-xmlrpc 2020-12-14 12:55:43 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:5401 https://access.redhat.com/errata/RHSA-2020:5401

Comment 20 errata-xmlrpc 2020-12-16 08:25:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:5567 https://access.redhat.com/errata/RHSA-2020:5567

Comment 21 RaTasha Tillery-Smith 2020-12-17 14:08:14 UTC
Statement:

In Red Hat Gluster Storage 3, PostgreSQL (embedded in rhevm-dependencies) was shipped as a part of the Red Hat Gluster Storage Console that is no longer supported for use with Red Hat Gluster Storage 3.5. Red Hat Gluster Storage Web Administration is now the recommended monitoring tool for Red Hat Storage Gluster clusters.
In Red Hat Virtualization, the manager appliance uses a vulnerable version of postgresql. Once a fix has been shipped for RHEL 8 the appliance can consume the fix via a regular yum update.

Comment 22 errata-xmlrpc 2020-12-17 15:53:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:5619 https://access.redhat.com/errata/RHSA-2020:5619

Comment 23 errata-xmlrpc 2020-12-17 15:58:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:5620 https://access.redhat.com/errata/RHSA-2020:5620

Comment 24 errata-xmlrpc 2020-12-21 10:10:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:5638 https://access.redhat.com/errata/RHSA-2020:5638

Comment 25 errata-xmlrpc 2020-12-22 08:53:21 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:5661 https://access.redhat.com/errata/RHSA-2020:5661

Comment 26 errata-xmlrpc 2020-12-22 09:27:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:5664 https://access.redhat.com/errata/RHSA-2020:5664

Comment 28 errata-xmlrpc 2021-01-11 10:54:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0057 https://access.redhat.com/errata/RHSA-2021:0057

Comment 29 errata-xmlrpc 2021-01-18 09:57:48 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0161 https://access.redhat.com/errata/RHSA-2021:0161

Comment 30 errata-xmlrpc 2021-01-18 09:58:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0163 https://access.redhat.com/errata/RHSA-2021:0163

Comment 31 errata-xmlrpc 2021-01-18 10:01:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0164 https://access.redhat.com/errata/RHSA-2021:0164

Comment 32 errata-xmlrpc 2021-01-18 16:15:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:0165 https://access.redhat.com/errata/RHSA-2021:0165

Comment 33 errata-xmlrpc 2021-01-18 16:19:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:0166 https://access.redhat.com/errata/RHSA-2021:0166

Comment 34 errata-xmlrpc 2021-01-18 16:22:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:0167 https://access.redhat.com/errata/RHSA-2021:0167


Note You need to log in before you can comment on or make changes to this bug.