CVE-2017-7548

PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.

PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.

libpq, and by extension any connection driver that utilizes libpq, ignores empty passwords and does not transmit them to the server. When using libpq or a libpq-based connection driver to perform password-based authentication methods, it would appear that setting an empty password would be the equivalent of disabling password login. However, using a non-libpq based connection driver could allow a client with an empty password to log in (CVE-2017-7546).

A user had access to see the options in pg_user_mappings even if the user did not have the USAGE permission on the associated foreign server. This meant that a user could see details such as a password that might have been set by the server administrator rather than the user (CVE-2017-7547).

The lo_put() function should require the same permissions as lowrite(), but there was a missing permission check which would allow any user to change the data in a large object (CVE-2017-7548).

Note: the CVE-2017-7547 issue requires manual intervention to fix on affected systems. See the references for details.

Postgresql93 was updated to 9.3.18 to fix the following issues:

• CVE-2017-7547: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1051685)
• CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. (bsc#1051684)
• CVE-2017-7548: lo_put() function ignores ACLs. (bsc#1053259)

The changelog for the release is here:

https://www.postgresql.org/docs/9.3/static/release-9-3-18.html

Postgresql94 was updated to 9.4.13 to fix the following issues:

• CVE-2017-7547: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1051685)
• CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. (bsc#1051684)
• CVE-2017-7548: lo_put() function ignores ACLs. (bsc#1053259)

The changelog for this release is here: https://www.postgresql.org/docs/9.4/static/release-9-4-13.html

This update for postgresql94 fixes the following issues:

• CVE-2017-7547: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1051685)
• CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. (bsc#1051684)
• CVE-2017-7548: lo_put() function ignores ACLs. (bsc#1053259)

This update for postgresql96 fixes the following issues:

• CVE-2017-7547: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1051685)
• CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. (bsc#1051684)
• CVE-2017-7548: lo_put() function ignores ACLs. (bsc#1053259)

The changelog for this release is here: https://www.postgresql.org/docs/9.6/static/release-9-6-4.html

Ben de Graaff, Jelte Fennema, and Jeroen van der Ham discovered that PostgreSQL allowed the use of empty passwords in some authentication methods, contrary to expected behaviour. A remote attacker could use an empty password to authenticate to servers that were believed to have password login disabled. (CVE-2017-7546)

Jeff Janes discovered that PostgreSQL incorrectly handled the pg_user_mappings catalog view. A remote attacker without server privileges could possibly use this issue to obtain certain passwords. (CVE-2017-7547)

Chapman Flack discovered that PostgreSQL incorrectly handled lo_put() permissions. A remote attacker could possibly use this issue to change the data in a large object. (CVE-2017-7548)