Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary SQL under the identity of the function owner. An attack requires EXECUTE permission on the function, which must itself contain a function call having inexact argument type match. For example, length('foo'::varchar) and length('foo') are inexact, while length('foo'::text) is exact. As part of exploiting this vulnerability, the attacker uses CREATE DOMAIN to create a type in a pg_temp schema. The attack pattern and fix are similar to that for CVE-2007-2138. Writing SECURITY DEFINER functions continues to require following the considerations noted in the documentation, though this vulnerability affects functions observing them and functions not observing them: References: https://www.postgresql.org/docs/devel/sql-createfunction.html#SQL-CREATEFUNCTION-SECURITY
Acknowledgments: Name: the PostgreSQL project Upstream: Tom Lane
The following products only contain the JBDC postgresql driver, not the server and are not affected: * Red Hat Decision Manager * Red Hat Process Automation Manager
Created mingw-postgresql tracking bugs for this issue: Affects: epel-7 [bug 1739217] Affects: fedora-all [bug 1739211] Created postgresql tracking bugs for this issue: Affects: fedora-all [bug 1739215]
External References: https://www.postgresql.org/about/news/1960/
Red Hat Gluster Storage 3 ships JDBC part of postgresql embedded in rhevm-dependencies, hence not affected.
Upstream fixes per branches : 9.4 : https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=8673743 9.5 : https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=752fa3d 9.6 : https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=7da4619 10 : https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=2062007 11 : https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=21f94c5
Hello, May I know if Linux PostgreSQL 7.1beta6 version is also affected by this vulnerability and requires the fix? Any heads up will be appreciated. Thank you in advance. Best Regards,
Mitigation: If your use case requires SECURITY DEFINER functions, please follow the advice below to write them safely so they do not rely on search_path and restrict the set of users which can access them. https://www.postgresql.org/docs/devel/sql-createfunction.html#SQL-CREATEFUNCTION-SECURITY
(In reply to Trupti Pardeshi from comment #12) > May I know if Linux PostgreSQL 7.1beta6 version is also affected by this > vulnerability and requires the fix? Any heads up will be appreciated. Hi, PostgreSQL 7.1 has not been tested. I believe that this version does not support SECURITY DEFINER (as far as I know, it was a new feature from 7.3). If so, then 7.1 might not be vulnerable.
Statement: Red Hat Virtualization Management Appliance included affected versions of postgresql, however no custom SECURITY DEFINER functions are declared so this vulnerability can not be exploited in the default configuration.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:3669 https://access.redhat.com/errata/RHSA-2020:3669
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-10208
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Via RHSA-2020:4295 https://access.redhat.com/errata/RHSA-2020:4295
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:5619 https://access.redhat.com/errata/RHSA-2020:5619
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:5661 https://access.redhat.com/errata/RHSA-2020:5661
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:5664 https://access.redhat.com/errata/RHSA-2020:5664
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2021:0164 https://access.redhat.com/errata/RHSA-2021:0164
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2021:0166 https://access.redhat.com/errata/RHSA-2021:0166
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2021:0167 https://access.redhat.com/errata/RHSA-2021:0167
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2021:1512 https://access.redhat.com/errata/RHSA-2021:1512