CVE-2018-1053
published 2018-02-09CVE-2018-1053: In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current…
PriorityP430high7CVSS 3.0
AVLACHPRLUINSUCHIHAH
EPSS
0.49%
39.0th percentile
In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| postgresql | postgresql | — | — |
| postgresql | postgresql | — | — |
| postgresql | postgresql | >= 0 < 10.2-r0 | 10.2-r0 |
| postgresql | postgresql | >= 0 < 10.2-r0 | 10.2-r0 |
| postgresql | postgresql | >= 0 < 10.2-r0 | 10.2-r0 |
| postgresql | postgresql | >= 0 < 10.2-r0 | 10.2-r0 |
| postgresql | postgresql | >= 0 < 10.2-r0 | 10.2-r0 |
| postgresql | postgresql | >= 0 < 9.5.11-r0 | 9.5.11-r0 |
| postgresql | postgresql | >= 0 < 9.6.7-r0 | 9.6.7-r0 |
| postgresql | postgresql | >= 0 < 9.6.7-r0 | 9.6.7-r0 |
| postgresql | postgresql | >= 0 < 10.2-r0 | 10.2-r0 |
| postgresql | postgresql | >= 0 < 10.2-r0 | 10.2-r0 |
| postgresql | postgresql | >= 0 < 10.2-r0 | 10.2-r0 |
| postgresql | postgresql | >= 9.3.0 < 9.3.21 | 9.3.21 |
| postgresql | postgresql | >= 9.4.0 < 9.4.16 | 9.4.16 |
| postgresql | postgresql | >= 9.5.0 < 9.5.11 | 9.5.11 |
| postgresql | postgresql | >= 9.6.0 < 9.6.7 | 9.6.7 |
| redhat | cloudforms | — | — |
| the_postgresql_global_development_group | postgresql | — | — |
| the_postgresql_global_development_group | postgresql | — | — |
| the_postgresql_global_development_group | postgresql | — | — |
CVSS provenance
nvdv3.07.0HIGHCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.03.3LOWAV:L/AC:M/Au:N/C:P/I:P/A:N
osv7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PostgreSQL vulnerability
vendor_ubuntu·2018-02-09
CVE-2018-1053 PostgreSQL vulnerability
Title: PostgreSQL vulnerability
Summary: PostgreSQL could be made to expose sensitive information.
It was discovered that PostgreSQL incorrectly handled certain temp files.
An attacker could possibly use this to access sensitive information.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.
Red Hat
postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask
vendor_redhat·2018-02-08·CVSS 7.0
CVE-2018-1053 [HIGH] CWE-377 postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask
postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask
In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.
This release of CloudForms corrects an issue invoked when runnin
GHSA
GHSA-h73g-3m4r-j2cr: In postgresql 9
ghsa_unreviewed·2022-05-13
CVE-2018-1053 [HIGH] CWE-732 GHSA-h73g-3m4r-j2cr: In postgresql 9
In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.
OSV
CVE-2018-1053: In postgresql 9
osv·2018-02-09·CVSS 7.0
CVE-2018-1053 [HIGH] CVE-2018-1053: In postgresql 9
In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.
No detection rules found.
Bugzilla
CVE-2018-10804 ImageMagick: Memory leak in WriteTIFFImage
bugzilla·2018-05-11·CVSS 6.5
CVE-2018-10804 [MEDIUM] CVE-2018-10804 ImageMagick: Memory leak in WriteTIFFImage
CVE-2018-10804 ImageMagick: Memory leak in WriteTIFFImage
A flaw was found in ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c.
References:
https://github.com/ImageMagick/ImageMagick/issues/1053
Discussion:
Created ImageMagick tracking bugs for this issue:
Affects: fedora-all [bug 1577400]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2020:1180 https://access.redhat.com/errata/RHSA-2020:1180
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2018-10804
Bugzilla
CVE-2018-1053 mingw-postgresql: postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask [fedora-all]
bugzilla·2018-02-09·CVSS 7.0
CVE-2018-1053 [HIGH] CVE-2018-1053 mingw-postgresql: postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask [fedora-all]
CVE-2018-1053 mingw-postgresql: postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE
Bugzilla
CVE-2018-1053 mingw-postgresql: postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask [epel-7]
bugzilla·2018-02-09·CVSS 7.0
CVE-2018-1053 [HIGH] CVE-2018-1053 mingw-postgresql: postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask [epel-7]
CVE-2018-1053 mingw-postgresql: postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Bugzilla
CVE-2018-1053 postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask [fedora-all]
bugzilla·2018-02-09·CVSS 7.0
CVE-2018-1053 [HIGH] CVE-2018-1053 postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask [fedora-all]
CVE-2018-1053 postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affec
Bugzilla
CVE-2018-1053 postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask
bugzilla·2018-01-29·CVSS 7.0
CVE-2018-1053 [HIGH] CVE-2018-1053 postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask
CVE-2018-1053 postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask
pg_upgrade creates temporary files in the current working directory. It
creates most of them with umask 0077, so only the current user can open those.
However, for the file containing the output of "pg_dumpall -g", it uses the
umask in effect when the user invoked pg_upgrade. This can allow an attacker
to read or modify the one file, which may contain encrypted or unencrypted
database passwords. However, the attack is infeasible if a directory mode
blocks the attacker searching the current working directory or if the
prevailing umask blocks the attacker opening the file.
Vulnerable Versions: 9.3 - 10
Discussion:
Acknowledgments:
Name: the PostgreSQL project
Upstream: Tom Lane
---
External
Bugzilla
CVE-2018-5727 openjpeg: integer overflow in opj_t1_encode_cblks in src/lib/openjp2/t1.c
bugzilla·2018-01-19·CVSS 6.5
CVE-2018-5727 [MEDIUM] CVE-2018-5727 openjpeg: integer overflow in opj_t1_encode_cblks in src/lib/openjp2/t1.c
CVE-2018-5727 openjpeg: integer overflow in opj_t1_encode_cblks in src/lib/openjp2/t1.c
A flaw was found in OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opj_t1_encode_cblks function in openjp2/t1.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
References:
https://github.com/uclouvain/openjpeg/issues/1053
Discussion:
Created openjpeg tracking bugs for this issue:
Affects: epel-all [bug 1536554]
Affects: fedora-all [bug 1536553]
---
Analysis:
I was able to reproduce this by using openjpeg compiled with -fsanitize=undefined. The following error message is displayed when the binary aborts:
[huzaifas@babylon bin]$ ./opj_compress -n 1 -i /tmp/openjpeg_2-3_opj_compress_integer-overflow_opj_t1_encode_cblk
http://www.securityfocus.com/bid/102986https://access.redhat.com/errata/RHSA-2018:2511https://access.redhat.com/errata/RHSA-2018:2566https://access.redhat.com/errata/RHSA-2018:3816https://lists.debian.org/debian-lts-announce/2018/02/msg00006.htmlhttps://usn.ubuntu.com/3564-1/https://www.postgresql.org/about/news/1829/http://www.securityfocus.com/bid/102986https://access.redhat.com/errata/RHSA-2018:2511https://access.redhat.com/errata/RHSA-2018:2566https://access.redhat.com/errata/RHSA-2018:3816https://lists.debian.org/debian-lts-announce/2018/02/msg00006.htmlhttps://usn.ubuntu.com/3564-1/https://www.postgresql.org/about/news/1829/
2018-02-09
Published