CVE-2022-40756: High severity Actian PSQL vulnerability
If folder security is misconfigured for Actian Zen PSQL BEFORE Patch Update 1 for Zen 15 SP1 (v15.11.005), Patch Update 4 for Zen 15 (v15.01.017), or Patch Update 5 for Zen 14 SP2 (v14.21.022), it can allow an attacker (with file read/write access) to remove specific security files in order to reset the master password and gain access to the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Actian Zen PSQLto a version that resolves this vulnerability.Fixed in v15.11.005Patch Patch Update 1 for Zen 15 SP1 - Upgrade
Upgrade
Actian Zen PSQLto a version that resolves this vulnerability.Fixed in v15.01.017Patch Patch Update 4 for Zen 15 - Upgrade
Upgrade
Actian Zen PSQLto a version that resolves this vulnerability.Fixed in v14.21.022Patch Patch Update 5 for Zen 14 SP2 - Compensating control
Ensure folder security is configured correctly for Actian Zen PSQL so an attacker with file read/write access cannot remove the specific security files used to reset the master password.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-40756?
CVE-2022-40756 has been classified as a medium severity vulnerability due to possible unauthorized access to sensitive security files.
How do I fix CVE-2022-40756?
To fix CVE-2022-40756, ensure your Actian Zen PSQL is updated to at least Patch Update 1 for Zen 15 SP1, Patch Update 4 for Zen 15, or Patch Update 5 for Zen 14 SP2.
What are the affected versions for CVE-2022-40756?
The affected versions of Actian Zen PSQL include versions prior to Patch Update 1 for Zen 15 SP1, Patch Update 4 for Zen 15, and Patch Update 5 for Zen 14 SP2.
How does CVE-2022-40756 impact data security?
CVE-2022-40756 can allow attackers with file read/write access to remove critical security files, potentially compromising system integrity.
What should I do if I cannot update to fix CVE-2022-40756?
If unable to update, review folder security configurations to limit file access and mitigate potential exploitation risks associated with CVE-2022-40756.