AI_ONLY_REPORT
package: ansible-collection-redhat-leapp-1.7.4-1.el10_2
------
Summary: Insecure Permissions on PostgreSQL Backup on Managed Node: the  
remediation task creates a PostgreSQL data backup archive with mode `0755`,  
allowing local non-root users on the managed node to read archived  
PostgreSQL data after remediation runs.
Requirements to exploit: A local authenticated user account on a managed  
node where the remediation workflow is executed with elevated privileges,  
`leapp_old_postgresql_data` is selected, and `/var/lib/pgsql/data` exists  
when the task runs.
Component affected: `ansible-collection-redhat-leapp-1.7.4-1.el10_2`,  
`roles/remediate/tasks/leapp_old_postgresql_data.yml`, task  
`leapp_old_postgresql_data`
Version affected: `ansible-collection-redhat-leapp-1.7.4-1.el10_2`
Patch available: no released package fix established; proposed patch  
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - 5.5 (MEDIUM)
AV:L - Exploitation requires local access to the managed node.
AC:L - Once the remediation runs, the exposed archive can be read  
directly with standard tools.
PR:L - The attacker needs a local account or equivalent local session on  
the affected system.
UI:N - No separate user interaction is required after the archive is  
created.
S:U - The impact is confined to the same security scope.
C:H - The archive may contain the full PostgreSQL data directory and  
therefore sensitive database contents.
I:N - The issue is an information exposure; the report does not  
establish unauthorized modification.
A:N - The report does not establish a direct availability impact.
Impact: Moderate. This issue can expose sensitive PostgreSQL data to local  
non-root users, but exploitation is not remote and depends on a specific  
remediation path being executed on systems that still contain  
`/var/lib/pgsql/data`. Under the Red Hat severity guidance, this is more  
appropriately classified as Moderate than Important because the exposure is  
conditional and local, even though the confidentiality impact can be  
significant on affected hosts.
Embargo: no
Reason: This is a local, configuration- and workflow-dependent  
confidentiality issue with straightforward mitigation by tightening backup  
directory and archive permissions.
Acknowledgement: Aisle Research
Vulnerability Details: The remediation task archives `/var/lib/pgsql/data`  
into `/var/backups`, then explicitly sets the resulting archive to mode  
`0755`. That makes the backup world-readable on typical systems. The task  
then removes the original PostgreSQL data directory, leaving the backup  
archive as the remaining copy in this workflow. The same task also sets  
`/var/backups` to `0755`, which may preserve or broaden directory  
readability depending on the existing system state. This remediation is  
part of the intended remediation flow for the Leapp inhibitor `Old  
PostgreSQL data found in /var/lib/pgsql/data`.
```yaml
name: leapp_old_postgresql_data | Ensure /var/backups exists
   ansible.builtin.file:
     path: "{{ postgresql_backup_path }}"
     state: directory
     mode: "0755"


name: leapp_old_postgresql_data | Create tar.gz archive of postgresql data
   ansible.builtin.command: # noqa: command-instead-of-module
     cmd: tar -czf {{ postgresql_backup_path }}/{{ backup_file_name }} {{  
postgresql_data_path }}
   changed_when: true


name: leapp_old_postgresql_data | Set permissions on backup archive
   ansible.builtin.file:
     path: "{{ postgresql_backup_path }}/{{ backup_file_name }}"
     mode: "0755"


name: leapp_old_postgresql_data | Remove original postgresql data
   ansible.builtin.file:
     path: "{{ postgresql_data_path }}"
     state: absent
```


The core security consequence established here is local confidentiality  
loss. The available evidence does not establish a direct integrity or  
availability impact, and it does not show remote reachability.
Steps to reproduce:
1. Prepare a managed node with `/var/lib/pgsql/data` present and populate  
it with sample files.
2. Run the remediation workflow so that task `leapp_old_postgresql_data`  
executes with elevated privileges.
3. Confirm that a backup archive named `pgsql_data_backup_*.tar.gz` is  
created under `/var/backups`.
4. Check the resulting permissions with `stat -c '%a %U:%G %n' /var/backups  
/var/backups/pgsql_data_backup_*.tar.gz`.
5. From a non-root local account, list the archive contents with `tar -tzf  
/var/backups/pgsql_data_backup_*.tar.gz`.
6. Observe that the archive remains readable to the local user while the  
original `/var/lib/pgsql/data` has been removed by the remediation.
Mitigation: Until a package fix is available, store these remediation  
backups in a root-only directory and set the archive permissions to `0600`.  
If the current task must be used as-is, restrict local-user access on  
affected systems and remove or re-permission the generated backup archive  
immediately after it is created.
Proposed Fix: Restrict the backup location to a dedicated root-owned  
directory and make the generated archive readable only by root.
```diff
diff --git a/roles/remediate/tasks/leapp_old_postgresql_data.yml  
b/roles/remediate/tasks/leapp_old_postgresql_data.yml
index 0000000..1111111 100644
— a/roles/remediate/tasks/leapp_old_postgresql_data.yml
+++ b/roles/remediate/tasks/leapp_old_postgresql_data.yml
@@ -2,8 +2,9 @@
name: leapp_old_postgresql_data | Backup and then remove  
/var/lib/pgsql/data for remediation
    vars:
      postgresql_data_path: /var/lib/pgsql/data

   postgresql_backup_path: /var/backups
+    postgresql_backup_path: /var/backups/leapp
    block:
@@ -27,7 +28,10 @@

name: leapp_old_postgresql_data | Ensure /var/backups exists
            ansible.builtin.file:
              path: "{{ postgresql_backup_path }}"
              state: directory

           mode: "0755"
+            owner: root
+            group: root
+            mode: "0700"


@@ -38,7 +42,10 @@
name: leapp_old_postgresql_data | Set permissions on backup  
archive
            ansible.builtin.file:
              path: "{{ postgresql_backup_path }}/{{ backup_file_name }}"

           mode: "0755"
+            owner: root
+            group: root
+            mode: "0600"
```


------
This report was generated using AI technology. Always review AI-generated  
content prior to use