CVE-2018-1053: High severity PostgreSQL postgresql vulnerability
In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pgupgrade creates file in current working directory containing the output of pgdumpall -g under umask which was in effect when the user invoked pgupgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.
Other sources
pgupgrade creates temporary files in the current working directory. It creates most of them with umask 0077, so only the current user can open those. However, for the file containing the output of "pgdumpall -g", it uses the umask in effect when the user invoked pgupgrade. This can allow an attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. However, the attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.
Vulnerable Versions: 9.3 - 10
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 9.3.21 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 9.4.16 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 9.5.11 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 9.6.7 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 10.2 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 9.3.21 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 9.4.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 9.5.11 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 9.6.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 10.2 - Configuration
Ensure the directory mode of the current working directory used by pg_upgrade blocks an attacker from searching that directory (so an attacker cannot access the pg_upgrade-generated temporary file).
pg_upgrade directory mode / current working directory access = block searching the current working directory - Configuration
Invoke pg_upgrade with a prevailing umask that blocks other users from opening the temporary file it creates in the current working directory (the text notes umask 0077 normally restricts access to only the invoking user).
pg_upgrade umask = blocks attacker opening the file
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-1053.
What is the severity of CVE-2018-1053?
CVE-2018-1053 has a severity level of high.
What is the affected software?
The affected software includes PostgreSQL versions 9.3.x, 9.4.x, 9.5.x, 9.6.x, and 10.x.
How can I fix CVE-2018-1053?
To fix CVE-2018-1053, upgrade to PostgreSQL versions 9.3.21, 9.4.16, 9.5.11, 9.6.7, or 10.2.
Are there any additional references for CVE-2018-1053?
Yes, you can find additional references for CVE-2018-1053 at the following links: [link1], [link2], [link3].