[ASA-201908-8] postgresql: multiple issues

[Remi Gacogne]

Arch Linux Security Advisory ASA-201908-8
=========================================

Severity: Medium
Date    : 2019-08-10
CVE-ID  : CVE-2019-10208 CVE-2019-10209
Package : postgresql
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1019

Summary
=======

The package postgresql before version 11.5-1 is vulnerable to multiple
issues including access restriction bypass and information disclosure.

Resolution
==========

Upgrade to 11.5-1.

# pacman -Syu "postgresql>=11.5-1"

The problems have been fixed upstream in version 11.5.

Workaround
==========

None.

Description
===========

- CVE-2019-10208 (access restriction bypass)

A security issue has been found in PostgreSQL < 11.5 where given a
suitable SECURITY DEFINER function, an attacker can execute arbitrary
SQL under the identity of the function owner. An attack requires
EXECUTE permission on the function, which must itself contain a
function call having inexact argument type match. For example,
length('foo'::varchar) and length('foo') are inexact, while
length('foo'::text) is exact. As part of exploiting this vulnerability,
the attacker uses CREATE DOMAIN to create a type in a pg_temp schema.
The attack pattern and fix are similar to that for CVE-2007-2138.

- CVE-2019-10209 (information disclosure)

An issue has been found in PostgreSQL >= 11.0 and < 11.5. In a database
containing hypothetical, user-defined hash equality operators, an
attacker could read arbitrary bytes of server memory. For an attack to
become possible, a superuser would need to create unusual operators. It
is possible for operators not purpose-crafted for attack to have the
properties that enable an attack, but we are not aware of specific
examples.

Impact
======

An authenticated attacker can read arbitrary bytes of server memory or
execute arbitrary SQL commands under a different identity than its own.

References
==========

https://www.postgresql.org/about/news/1960/
https://bugzilla.redhat.com/show_bug.cgi?id=1734416
https://bugzilla.redhat.com/show_bug.cgi?id=1734447
https://security.archlinux.org/CVE-2019-10208
https://security.archlinux.org/CVE-2019-10209

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20190812/6beceec1/attachment.sig>