CVE-2018-1058: Input Validation
A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database.
Other sources
From upstream advisory:
Supported, Vulnerable Versions: 9.3 - 10. The security team typically does not test unsupported versions, but this problem is quite old.
The PostgreSQL searchpath setting determines schemas searched for tables, functions, operators, etc. The pgdump client application chooses searchpath settings such that every schema may appear at the front of its search path. This permits a user with CREATE privilege on any schema to execute arbitrary SQL functions under the identity of the user running pgdump, often a superuser. This is exploitable in the default configuration, where all users have CREATE privilege on schema "public". The pgupgrade implementation invokes pgdump under a superuser identity, and its usage is vulnerable.
Other client applications, such as vacuumdb, leave searchpath unchanged. In the default configuration, users can create objects in the "public" schema and harness them to execute arbitrary SQL functions under the identity of the user running these programs. The PostgreSQL project estimates this class of vulnerability is pervasive in applications that query PostgreSQL databases, so we are issuing guidance for database administrators and application authors to secure their own work. In brief, one can issue "REVOKE CREATE ON SCHEMA public FROM PUBLIC" to prevent these attacks.
— Red Hat
Postgresql could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the searchpath setting. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code with the permissions of superuser in the database.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cfmeto a version that resolves this vulnerability.Fixed in 0:5.9.6.5-3.el7cf - Upgrade
Upgrade
redhat/cfme-amazon-smartstateto a version that resolves this vulnerability.Fixed in 0:5.9.6.5-2.el7cf - Upgrade
Upgrade
redhat/cfme-applianceto a version that resolves this vulnerability.Fixed in 0:5.9.6.5-1.el7cf - Upgrade
Upgrade
redhat/cfme-gemsetto a version that resolves this vulnerability.Fixed in 0:5.9.6.5-2.el7cf - Upgrade
Upgrade
redhat/dbus-api-serviceto a version that resolves this vulnerability.Fixed in 0:1.0.1-3.1.el7cf - Upgrade
Upgrade
redhat/httpd-configmap-generatorto a version that resolves this vulnerability.Fixed in 0:0.2.2-1.2.el7cf - Upgrade
Upgrade
redhat/postgresql96to a version that resolves this vulnerability.Fixed in 0:9.6.10-1PGDG.el7a - Upgrade
Upgrade
redhat/rh-postgresql95-postgresqlto a version that resolves this vulnerability.Fixed in 0:9.5.14-1.el6 - Upgrade
Upgrade
redhat/rh-postgresql96-postgresqlto a version that resolves this vulnerability.Fixed in 0:9.6.10-1.el6 - Upgrade
Upgrade
redhat/rh-postgresql95-postgresqlto a version that resolves this vulnerability.Fixed in 0:9.5.14-1.el7 - Upgrade
Upgrade
redhat/rh-postgresql96-postgresqlto a version that resolves this vulnerability.Fixed in 0:9.6.10-1.el7 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 10.3 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 9.6.8 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 9.5.12 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 9.4.17 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 9.3.22 - Configuration
Mitigate CVE-2018-1058-style search_path exploitation by securing the PostgreSQL search_path setting so it cannot be influenced to resolve objects from attacker-controlled schemas (as suggested in the upstream mitigation guidance).
PostgreSQL search_path = Set search_path so that every schema may appear at the front of its search path. - Configuration
In the affected versions (9.3 through 10), prevent arbitrary-code execution via search_path by revoking CREATE privilege on the public schema (e.g., issue: REVOKE CREATE ON SCHEMA public FROM PUBLIC) so non-superusers cannot create objects in public.
PostgreSQL REVOKE CREATE ON SCHEMA public = REVOKE CREATE ON SCHEMA public - Compensating control
If the database uses pg_dump/pg_upgrade/vacuumdb and other client applications that leave search_path unchanged or invoke components under elevated identity, ensure their search_path is not attacker-controlled and protect/secure the execution context per the upstream search_path protection guidance.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2018-1058?
CVE-2018-1058 is a vulnerability in Postgresql that could allow a remote attacker to execute arbitrary code on the system.
How does CVE-2018-1058 affect Postgresql?
CVE-2018-1058 affects Postgresql by allowing a remote authenticated attacker to modify the behavior of a query for other users, potentially executing arbitrary code with superuser permissions.
What is the severity of CVE-2018-1058?
The severity of CVE-2018-1058 is rated as high, with a CVSS score of 8.8 out of 10.
Which versions of Postgresql are affected by CVE-2018-1058?
Postgresql versions 10.3, 9.6.8, 9.5.12, 9.4.17, and 9.3.22 are affected by CVE-2018-1058.
How can I fix the CVE-2018-1058 vulnerability?
To fix the CVE-2018-1058 vulnerability, update Postgresql to version 10.3 or apply the necessary patches provided by the vendor.