| Revision Date: | 2019-04-01 | Version: | 1 | | Title: | CVE-2019-9193 on Ubuntu 18.04 LTS (bionic) - medium. | | Description: | ** DISPUTED ** In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_read_server_files' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ?COPY TO/FROM PROGRAM? is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ?COPY FROM PROGRAM?. Furthermore, members in 'pg_read_server_files' can run commands only if either the 'pg_execute_server_program' role or superuser are granted. | | Family: | unix | Class: | vulnerability | | Status: | | Reference(s): | CVE-2019-9193
| | Platform(s): | Ubuntu 18.04 LTS
| Product(s): | | | Definition Synopsis | | Ubuntu 18.04 LTS (bionic) is installed. AND Package Information
NOT libecpg-compat3 package in bionic, while related to the CVE in some way, is not affected.
OR NOT libecpg6 package in bionic, while related to the CVE in some way, is not affected.
OR NOT libpgtypes3 package in bionic, while related to the CVE in some way, is not affected.
OR NOT libpq5 package in bionic, while related to the CVE in some way, is not affected.
OR NOT postgresql-10 package in bionic, while related to the CVE in some way, is not affected.
OR NOT postgresql-client-10 package in bionic, while related to the CVE in some way, is not affected.
OR NOT postgresql-plperl-10 package in bionic, while related to the CVE in some way, is not affected.
OR NOT postgresql-plpython-10 package in bionic, while related to the CVE in some way, is not affected.
OR NOT postgresql-plpython3-10 package in bionic, while related to the CVE in some way, is not affected.
OR NOT postgresql-pltcl-10 package in bionic, while related to the CVE in some way, is not affected.
|
|