CVE-2017-7546

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.

libpq, and by extension any connection driver that utilizes libpq, ignores empty passwords and does not transmit them to the server. When using libpq or a libpq-based connection driver to perform password-based authentication methods, it would appear that setting an empty password would be the equivalent of disabling password login. However, using a non-libpq based connection driver could allow a client with an empty password to log in (CVE-2017-7546).

A user had access to see the options in pg_user_mappings even if the user did not have the USAGE permission on the associated foreign server. This meant that a user could see details such as a password that might have been set by the server administrator rather than the user (CVE-2017-7547).

The lo_put() function should require the same permissions as lowrite(), but there was a missing permission check which would allow any user to change the data in a large object (CVE-2017-7548).

Note: the CVE-2017-7547 issue requires manual intervention to fix on affected systems. See the references for details.

Postgresql93 was updated to 9.3.18 to fix the following issues:

• CVE-2017-7547: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1051685)
• CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. (bsc#1051684)
• CVE-2017-7548: lo_put() function ignores ACLs. (bsc#1053259)

The changelog for the release is here:

https://www.postgresql.org/docs/9.3/static/release-9-3-18.html

Postgresql94 was updated to 9.4.13 to fix the following issues:

• CVE-2017-7547: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1051685)
• CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. (bsc#1051684)
• CVE-2017-7548: lo_put() function ignores ACLs. (bsc#1053259)

The changelog for this release is here: https://www.postgresql.org/docs/9.4/static/release-9-4-13.html

This update for postgresql94 fixes the following issues:

• CVE-2017-7547: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1051685)
• CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. (bsc#1051684)
• CVE-2017-7548: lo_put() function ignores ACLs. (bsc#1053259)

This update for postgresql96 fixes the following issues:

• CVE-2017-7547: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1051685)
• CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. (bsc#1051684)
• CVE-2017-7548: lo_put() function ignores ACLs. (bsc#1053259)

The changelog for this release is here: https://www.postgresql.org/docs/9.6/static/release-9-6-4.html

Ben de Graaff, Jelte Fennema, and Jeroen van der Ham discovered that PostgreSQL allowed the use of empty passwords in some authentication methods, contrary to expected behaviour. A remote attacker could use an empty password to authenticate to servers that were believed to have password login disabled. (CVE-2017-7546)

Jeff Janes discovered that PostgreSQL incorrectly handled the pg_user_mappings catalog view. A remote attacker without server privileges could possibly use this issue to obtain certain passwords. (CVE-2017-7547)

Chapman Flack discovered that PostgreSQL incorrectly handled lo_put() permissions. A remote attacker could possibly use this issue to change the data in a large object. (CVE-2017-7548)