-
Notifications
You must be signed in to change notification settings - Fork 251
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #5597 from EnterpriseDB/docs/sec/cveupdatemay24
Docs/sec/cveupdatemay24
- Loading branch information
Showing
13 changed files
with
251 additions
and
76 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| --- | ||
| title: CVE-2024-4545 - EDB Postgres Advanced Server (EPAS) authenticated file read permissions bypass using edbldr | ||
| navTitle: CVE-2024-4545 | ||
| affectedProducts: All versions of EDB Postgres Advanced Server (EPAS) edbldr from 15.0 and prior to 15.7.0 and from 16.0 and prior to 16.3.0 | ||
| --- | ||
|
|
||
| First Published: 2024/05/09 | ||
|
|
||
| Last Updated: 2024/05/09 | ||
|
|
||
| ## Summary | ||
|
|
||
| All versions of EnterpriseDB Postgres Advanced Server (EPAS) from 15.0 and prior to 15.7.0 and from 16.0 and prior to 16.3.0 may allow users using `edbldr` to bypass role permissions from `pg_read_server_files`. This could allow low privilege users to read files to which they would not otherwise have access. | ||
|
|
||
| ## Vulnerability details | ||
|
|
||
| CVE-ID: [CVE-2024-4545](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4545) | ||
|
|
||
| CVSS Base Score: 7.7 | ||
|
|
||
| CVSS Temporal Score: Undefined | ||
|
|
||
| CVSS Environmental Score: Undefined | ||
|
|
||
| CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | ||
|
|
||
| ## Affected products and versions | ||
|
|
||
| * EnterpriseDB Postgres Advanced Server (EPAS) | ||
| * All versions from 15.0 and prior to 15.7.0 | ||
| * All versions from 16.0 and prior to 16.3.0 | ||
|
|
||
| ## Remediation | ||
|
|
||
| Impacted users must upgrade to a fixed version of EPAS. For questions about updating, users can contact their account representative or [contact EDB](https://www.enterprisedb.com/contact). | ||
|
|
||
| | Product | VRMF | Remediation/First Fix | | ||
| |---------|------|-----------------------| | ||
| | EPAS | All versions from 15.0 and prior to 15.7.0 | [Upgrade EPAS 15 to Minor release](https://www.enterprisedb.com/docs/epas/15/upgrading/04_upgrading_an_installation_with_pg_upgrade/01_performing_an_upgrade/) | | ||
| | EPAS | All versions from 16.0 and prior to 16.7.0 | [Upgrade EPAS 16 to Minor release](https://www.enterprisedb.com/docs/epas/16/upgrading/04_upgrading_an_installation_with_pg_upgrade/01_performing_an_upgrade/) | | ||
|
|
||
| !!! Warning | ||
| If impacted users are currently relying on non-superusers to run edbldr and read data from the server filesystem without any special permissions, the fixed versions of EPAS could break these workflows. It is recommended that users do one of the following: | ||
| * Grant such users the `pg_read_server_files` role | ||
| * Change the way data is being loaded into the database, such as loading files from standard input rather than specifying a pathname. | ||
| !!! | ||
|
|
||
| ## References | ||
|
|
||
| * [CVSS Calculator v3.1](https://www.first.org/cvss/calculator/3.1) | ||
| * [CWE-284 Improper Access Control](http://cwe.mitre.org/data/definitions/284.html) | ||
|
|
||
|
|
||
| ## Related information | ||
|
|
||
| * [EnterpriseDB](https://www.enterprisedb.com/) | ||
| * [PostgreSQL](https://www.postgresql.org/) | ||
| * [EDB Postgres Advanced Server (EPAS)](https://www.enterprisedb.com/products/edb-postgres-advanced-server) | ||
| * [EDB Blogs link](https://enterprisedb.com/blog/) | ||
|
|
||
| ## Acknowledgement | ||
|
|
||
| None | ||
|
|
||
| ## Change history | ||
|
|
||
| * 9 May 2024: Original document published | ||
|
|
||
| ## Disclaimer | ||
|
|
||
| This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document is at your own risk. EDB reserves the right to change or update this document at any time. Customers are therefore recommended to always view the latest version of this document. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| --- | ||
| title: CVE-2024-4317 - Restrict visibility of "pg_stats_ext" and "pg_stats_ext_exprs" entries to the table owner | ||
| navTitle: CVE-2024-4317 | ||
| affectedProducts: TBD | ||
| --- | ||
|
|
||
| First Published: 2024/05/09 | ||
|
|
||
| Last Updated: 2024/05/09 | ||
|
|
||
| Important: This is an assessment of the impact of CVE-2024-4317 on EDB products and services. It links to and details the CVE and supplements that information with EDB's own assessment. | ||
|
|
||
| ## Summary | ||
|
|
||
| Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes, which are provided as a convenience in the below section. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected. | ||
|
|
||
|
|
||
| ## Vulnerability details | ||
|
|
||
| CVE-ID: [CVE-2024-4317](https://www.postgresql.org/support/security/CVE-2024-4317/) | ||
|
|
||
| CVSS Base Score: 3.1 | ||
|
|
||
| CVSS Temporal Score: Undefined | ||
|
|
||
| CVSS Environmental Score: Undefined | ||
|
|
||
| CVSS Vector: TBC | ||
|
|
||
| ## Affected products and versions | ||
|
|
||
| ### PostgreSQL | ||
|
|
||
| * All versions of PostgreSQL prior to 16.3 | ||
| * All versions of PostgreSQL prior to 15.7 | ||
| * All versions of PostgreSQL prior to 14.12 | ||
|
|
||
| ### EnterpriseDB Postgres Advanced Server (EPAS) | ||
|
|
||
| * All versions of EPAS prior to 16.3 | ||
| * All versions of EPAS prior to 15.7 | ||
| * All versions of EPAS prior to 14.12 | ||
|
|
||
| ### EnterpriseDB Postgres Extended | ||
|
|
||
| * All versions of PGE prior to 16.3 | ||
| * All versions of PGE prior to 15.7 | ||
| * All versions of PGE prior to 14.12 | ||
|
|
||
| ## Remediation/fixes | ||
|
|
||
| The fix is included in the following versions: 16.3, 15.7, and 14.12. | ||
|
|
||
| Installing the fix will not remove the vulnerability from existing installations. To remove the vulnerability, follow the instructions in the [CVE-2024-4317](https://www.postgresql.org/support/security/CVE-2024-4317/) advisory. | ||
|
|
||
| ### PostgreSQL Version Information | ||
|
|
||
| | Affected Version | Fixed In | Fix Published | | ||
| |-----------------------------|----------|---------------| | ||
| | All versions prior to 16.3 | 16.3 | 2024-05-09 | | ||
| | All versions prior to 15.7 | 15.7 | 2024-05-09 | | ||
| | All versions prior to 14.12 | 14.12 | 2024-05-09 | | ||
|
|
||
| ### EPAS Version Information | ||
|
|
||
| | Product | VRMF | Remediation/First Fix | | ||
| |---------|--------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------| | ||
| | EPAS | All versions prior to 16.3 | Update to version 16.3 or later | | ||
| | EPAS | All versions prior to 15.7 | Update to version 15.7 or later | | ||
| | EPAS | All versions prior to 14.12 | Update to version 14.12 or later | | ||
|
|
||
| ### PGE Version Information | ||
|
|
||
| | Product | VRMF | Remediation/First Fix | | ||
| |---------|--------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------| | ||
| | PGE | All versions prior to 16.3 | Update to version 16.3 or later | | ||
| | PGE | All versions prior to 15.7 | Update to version 15.7 or later | | ||
| | PGE | All versions prior to 14.12 | Update to version 14.12 or later | | ||
|
|
||
| ## References | ||
|
|
||
| * [CVSS Calculator v3.1](https://www.first.org/cvss/calculator/3.1) | ||
| * [CWE-284 Improper Access Control](http://cwe.mitre.org/data/definitions/284.html) | ||
|
|
||
| ## Related information | ||
|
|
||
| * [EnterpriseDB](https://www.enterprisedb.com/) | ||
| * [EDB Blogs link](https://enterprisedb.com/blog/) | ||
|
|
||
| ## Acknowledgement | ||
|
|
||
| Source: PostgreSQL.org | ||
|
|
||
| ## Change history | ||
|
|
||
| 9 May 2024: Original Copy Published | ||
|
|
||
| ## Disclaimer | ||
|
|
||
| This document is provided on an "as is" basis and does not imply any kind of | ||
| guarantee or warranty, including the warranties of merchantability or fitness | ||
| for a particular use. Your use of the information on the document is at your own | ||
| risk. EDB reserves the right to change or update this document at any time. | ||
| Customers are therefore recommended to always view the latest version of this | ||
| document. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
8c3ec6eThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎉 Published on https://edb-docs-staging.netlify.app as production
🚀 Deployed on https://663cebda1ecee8075687bb73--edb-docs-staging.netlify.app