CVE-2007-2138: Medium severity PostgreSQL postgresql vulnerability
+++ This bug was initially created as a clone of Bug #237680 +++
Quoting the PostgreSQL release notes: http://www.postgresql.org/docs/8.2/static/release-8-2-4.html
Support explicit placement of the temporary-table schema within searchpath, and disable searching it for functions and operators (Tom)
This is needed to allow a security-definer function to set a truly secure value of searchpath. Without it, an unprivileged SQL user can use temporary objects to execute code with the privileges of the security-definer function (CVE-2007-2138). See CREATE FUNCTION for more information.
This flaw also affects FC5 and FC7
Other sources
Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function owner, related to "searchpath settings."
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2007-2138?
CVE-2007-2138 is considered a moderate severity vulnerability due to the potential privilege escalation it causes.
How do I fix CVE-2007-2138?
To fix CVE-2007-2138, upgrade to PostgreSQL version 7.3.19, 7.4.17, 8.0.13, 8.1.9, or 8.2.4 or later.
Who is affected by CVE-2007-2138?
CVE-2007-2138 affects users of PostgreSQL versions before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4.
What type of vulnerability is CVE-2007-2138?
CVE-2007-2138 is an untrusted search path vulnerability that allows remote authenticated users to gain additional privileges.
What are the potential impacts of CVE-2007-2138?
CVE-2007-2138 can lead to unauthorized access and privilege escalation, potentially compromising database security.