Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.1668
Security issues fixed with PostgreSQL 11.3, 10.8, 9.6.13,
9.5.17, and 9.4.22
13 May 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: postgresql
Publisher: PostgreSQL
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Access Privileged Data -- Existing Account
Unauthorised Access -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2019-10130 CVE-2019-10129 CVE-2019-10128
CVE-2019-10127
Reference: ESB-2019.1640
Original Bulletin:
https://www.postgresql.org/about/news/1939/
- --------------------------BEGIN INCLUDED TEXT--------------------
PostgreSQL 11.3, 10.8, 9.6.13, 9.5.17, and 9.4.22 Released!
Posted on 2019-05-09 by PostgreSQL Global Development Group
The PostgreSQL Global Development Group has released an update to all supported
versions of our database system, including 11.3, 10.8, 9.6.13, 9.5.17, and
9.4.22. This release fixes two security issues in the PostgreSQL server, a
security issue found in two of the PostgreSQL Windows installers, and over 60
bugs reported over the last three months.
Users who installed PostgreSQL using the Windows installers from EnterpriseDB
and BigSQL respectively should upgrade as soon as possible. Similarly, users
who are running any version of PostgreSQL 9.5, 9.6, 10, and 11 should also plan
to upgrade as soon as possible.
All other users should plan to apply this update at the next scheduled
downtime.
Security Issues
Four security vulnerabilities have been closed by this release:
o CVE-2019-10127: BigSQL Windows installer does not clear permissive ACL
entries
o CVE-2019-10128: EnterpriseDB Windows installer does not clear permissive
ACL entries
Due to both the EnterpriseDB and BigSQL Windows installers not locking down the
permissions of the PostgreSQL binary installation directory and the data
directory, an unprivileged Windows user account and an unprivileged PostgreSQL
account could cause the PostgreSQL service account to execute arbitrary code.
This vulnerability is present in all supported versions of PostgreSQL for these
installers, and possibly exists in older versions. Both sets of installers have
fixed the permissions for these directories for both new and existing
installations. If you have installed PostgreSQL on Windows using other methods,
we advise that you check that your PostgreSQL binary directories are writable
only to trusted users and that your data directories are only accessible to
trusted users.
The PostgreSQL project thanks Conner Jones for reporting this problem.
o CVE-2019-10129: Memory disclosure in partition routing
Prior to this release, a user running PostgreSQL 11 can read arbitrary bytes of
server memory by executing a purpose-crafted INSERT statement to a partitioned
table.
o CVE-2019-10130: Selectivity estimators bypass row security policies
PostgreSQL maintains statistics for tables by sampling data available in
columns; this data is consulted during the query planning process. Prior to
this release, a user able to execute SQL queries with permissions to read a
given column could craft a leaky operator that could read whatever data had
been sampled from that column. If this happened to include values from rows
that the user is forbidden to see by a row security policy, the user could
effectively bypass the policy. This is fixed by only allowing a non-leakproof
operator to use this data if there are no relevant row security policies for
the table.
This issue is present in PostgreSQL 9.5, 9.6, 10, and 11. The PostgreSQL
project thanks Dean Rasheed for reporting this problem.
Bug Fixes and Improvements
This update also fixes over 60 bugs that were reported in the last several
months. Some of these issues affect only version 11, but many affect all
supported versions.
Some of these fixes include:
o Several catalog corruption fixes, including one related to running ALTER
TABLE on a partitioned table
o Several fixes for partitioning
o Avoid server crash when an error occurs while trying to persist a cursor
query across a transaction commit
o Avoid O(N^2) performance issue when rolling back a transaction that created
many tables
o Fix possible "could not access status of transaction" failures in
txid_status()
o Fix updatable views to handle explicit DEFAULT items in INSERT .. VALUES
statements where there are multiple VALUES rows
o Fix CREATE VIEW to allow zero-column views
o Add missing support for the CREATE TABLE IF NOT EXISTS .. AS EXECUTE ..
statement
o Ensure that sub-SELECTs appearing in row-level-security policy expressions
are executed with the correct user's permissions
o Accept XML documents as valid values of type xml when xmloption is set to
content, as required by SQL:2006 and later
o Fix incompatibility of GIN-index WAL records that were introduced in 11.2,
10.7, 9.6.12, 9.5.16, and 9.4.21 that affected replica servers running
these versions reading in changes to GIN indexes from primary servers of
older versions
o Several memory leak fixes as well as fixes to management of dynamic shared
memory
o Relax panics on fsync and sync_file_range failures for certain cases where
a failure indicated "operation not supported"
o Several fixes to the query planner, several of which should lead to
planning improvements
o Fix race condition in which a hot-standby postmaster could fail to shut
down after receiving a smart-shutdown request
o Several fixes for SCRAM authentication
o Fix handling of lc_time settings that imply an encoding different from the
database's encoding
o Create the current_logfiles file with the same permissions as other files
in the server's data directory
o Several ecpg fixes
o Make pg_verify_checksums verify that the data directory it's pointed at is
of the right PostgreSQL version
o Several fixes for contrib/postgres_fdw, including one for remote partitions
where an UPDATE could lead to incorrect results or a crash
o Several Windows fixes
This update also contains tzdata release 2019a for DST law changes in Palestine
and Metlakatla, plus historical corrections for Israel. Etc/UCT is now a
backward-compatibility link to Etc/UTC, instead of being a separate zone that
generates the abbreviation UCT, which nowadays is typically a typo. PostgreSQL
will still accept UCT as an input zone abbreviation, but it won't output it.
Updating
All PostgreSQL update releases are cumulative. As with other minor releases,
users are not required to dump and reload their database or use pg_upgrade in
order to apply this update release; you may simply shutdown PostgreSQL and
update its binaries.
Users who have skipped one or more update releases may need to run additional,
post-update steps; please see the release notes for earlier versions for
details.
PostgreSQL 9.4 will stop receiving fixes on February 13, 2020. Please see our
versioning policy for more information.
Copyright (C) 1996-2019 The PostgreSQL Global Development Group
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXNkIT2aOgq3Tt24GAQiryhAA2+GY3pjzbWZlR2M5uCFHPUYAWLTt1zW6
f5C4wDgLlXeqJJaxXgorZI3t7lsWf4lnBonf84do6/TxT/OJY+hxzHNdcmG9+9sS
IMbPMtnAoQXVTvAp/83pAgyqMyYhaSsSJ2mvHOpodg31UFFwLDhHUj4enEdKUihT
ihDVOqrW9ZbpgFY+S1hTnjLipavyPaaEsVKQOxv0XfGiORND9YPzfa1UFY3d219i
CdYpyTmgR5yZNf4mAh2amLS1AkRdSnsBTUhe3LOpfgERKB5acm5R4O9moeqCectl
8QsfsS08Ne2syv+Lb4w7c4Oqb8Xjlf6mk4d7j8ansNqMEcNfetYG58CRvNrl+Uux
sAf/HLHEoxWXnb7amuI2zfsGEQ20Fe/QhsATOJT4CUCw7htlW+arKGLusmkVA0L+
93k4lR/toZoZdRqgszZfPCq5/EgB7dsnnCMfEVKsbJhn4LwfMmnNiFdOt28KbzQA
fJsWN5LpQT0gm+IYVbjYReTYV8OWbdCICAzd8JOaDKIjqZjmoxEM8xpOOkvlK8/p
apn7JAozKmA1aJceRX3CaH6JTMYDQ7rKe880cPdUxUYexGJvAUirMnMSIjQDVrbh
PWuyR3c4ic4FwMhn34byYtYWDAM46079tp24GUKQxAn10TDNxCOFCTNjzzVpHjfg
qVtFFVT167g=
=87Jr
-----END PGP SIGNATURE-----