Bug 1734416 (CVE-2019-10208) - CVE-2019-10208 postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution
Summary: CVE-2019-10208 postgresql: TYPE in pg_temp executes arbitrary SQL during SECU...
Keywords:
Status: NEW
Alias: CVE-2019-10208
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1741488 1741492 1741493 1739211 1739215 1739217 1741489 1741490 1741491
Blocks: 1734467
TreeView+ depends on / blocked
 
Reported: 2019-07-30 13:52 UTC by msiddiqu
Modified: 2019-09-29 15:18 UTC (History)
44 users (show)

Fixed In Version: postgresql 11.5, postgresql 10.10, postgresql 9.6.15, postgresql 9.5.19, postgresql 9.4.24
Doc Type: If docs needed, set a value
Doc Text:
A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description msiddiqu 2019-07-30 13:52:35 UTC
Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary
SQL under the identity of the function owner.  An attack requires EXECUTE
permission on the function, which must itself contain a function call having
inexact argument type match.  For example, length('foo'::varchar) and
length('foo') are inexact, while length('foo'::text) is exact.  As part of
exploiting this vulnerability, the attacker uses CREATE DOMAIN to create a
type in a pg_temp schema.  The attack pattern and fix are similar to that for
CVE-2007-2138.  Writing SECURITY DEFINER functions continues to require
following the considerations noted in the documentation, though this
vulnerability affects functions observing them and functions not observing
them:

References: 

https://www.postgresql.org/docs/devel/sql-createfunction.html#SQL-CREATEFUNCTION-SECURITY

Comment 1 msiddiqu 2019-07-30 13:55:47 UTC
Acknowledgments:

Name: the PostgreSQL project
Upstream: Tom Lane

Comment 3 Joshua Padman 2019-07-31 05:10:20 UTC
The following products only contain the JBDC postgresql driver, not the server and are not affected:
* Red Hat Decision Manager
* Red Hat Process Automation Manager

Comment 6 msiddiqu 2019-08-08 18:40:10 UTC
Created mingw-postgresql tracking bugs for this issue:

Affects: epel-7 [bug 1739217]
Affects: fedora-all [bug 1739211]


Created postgresql tracking bugs for this issue:

Affects: fedora-all [bug 1739215]

Comment 7 msiddiqu 2019-08-09 09:43:06 UTC
External References:

https://www.postgresql.org/about/news/1960/

Comment 8 Hardik Vyas 2019-08-14 09:07:38 UTC
Red Hat Gluster Storage 3 ships JDBC part of postgresql embedded in rhevm-dependencies, hence not affected.

Comment 12 Trupti Pardeshi 2019-08-19 07:53:17 UTC
Hello,

May I know if Linux PostgreSQL 7.1beta6 version is also affected by this vulnerability and requires the fix? Any heads up will be appreciated.

Thank you in advance.

Best Regards,

Comment 13 Doran Moppert 2019-08-20 05:30:58 UTC
Mitigation:

If your use case requires SECURITY DEFINER functions, please follow the advice below to write them safely so they do not rely on search_path and restrict the set of users which can access them.

https://www.postgresql.org/docs/devel/sql-createfunction.html#SQL-CREATEFUNCTION-SECURITY

Comment 14 Cedric Buissart 🐶 2019-08-20 08:12:20 UTC
(In reply to Trupti Pardeshi from comment #12)
> May I know if Linux PostgreSQL 7.1beta6 version is also affected by this
> vulnerability and requires the fix? Any heads up will be appreciated.
Hi,

PostgreSQL 7.1 has not been tested. I believe that this version does not support SECURITY DEFINER (as far as I know, it was a new feature from 7.3). If so, then 7.1 might not be vulnerable.

Comment 15 Eric Christensen 2019-08-20 18:35:31 UTC
Statement:

Red Hat Virtualization Management Appliance included affected versions of postgresql, however no custom SECURITY DEFINER functions are declared so this vulnerability can not be exploited in the default configuration.


Note You need to log in before you can comment on or make changes to this bug.