REDHAT-BUG-1464032
First published: Thu Jun 22 2017(Updated: )
It was found that Berkeley DB reads the DB_CONFIG configuration file from the current working directory by default. This happens when calling db_create() with dbenv=NULL; or using the dbm_open() function. References: <a href="http://seclists.org/oss-sec/2017/q2/452">http://seclists.org/oss-sec/2017/q2/452</a> <a href="http://www.postfix.org/announcements/postfix-3.2.2.html">http://www.postfix.org/announcements/postfix-3.2.2.html</a> Proposed patch: <a href="http://seclists.org/oss-sec/2017/q2/475">http://seclists.org/oss-sec/2017/q2/475</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Berkeley DB |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://seclists.org/oss-sec/2017/q2/452
- http://www.postfix.org/announcements/postfix-3.2.2.html
- http://seclists.org/oss-sec/2017/q2/475
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1464033
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1464035
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1464034
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1464032#c2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1464032#c3
- http://pkgs.fedoraproject.org/cgit/rpms/libdb.git/commit/?id=8047fa8580659fcae740c25e91b490539b8453eb
- https://bugs.launchpad.net/ubuntu/+source/libnss-db/+bug/531976
- https://access.redhat.com/security/cve/CVE-2010-0826
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=580187
- https://access.redhat.com/security/updates/classification/
- https://access.redhat.com/errata/RHSA-2019:0366
- https://bugzilla.redhat.com/show_bug.cgi?id=1464032
Frequently Asked Questions
What is the severity of REDHAT-BUG-1464032?
The severity of REDHAT-BUG-1464032 is classified as moderate risk due to potential exposure to sensitive data.
How do I fix REDHAT-BUG-1464032?
To fix REDHAT-BUG-1464032, ensure that the DB_CONFIG file is located in a secure directory and consider specifying an absolute path in your application.
What versions of Berkeley DB are affected by REDHAT-BUG-1464032?
REDAHT-BUG-1464032 affects all versions of Oracle Berkeley DB that read the DB_CONFIG from the current working directory.
What is the impact of REDHAT-BUG-1464032?
The impact of REDHAT-BUG-1464032 includes the risk of misconfigured database environments leading to unauthorized access to database configurations.
Can REDHAT-BUG-1464032 lead to data breaches?
Yes, REDHAT-BUG-1464032 can potentially lead to data breaches if an attacker is able to access the DB_CONFIG file containing sensitive settings.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-10140
- agent/source
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/berkeley db