You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: CVE-2020-10531 - Integer overflow in ICU doAppend()
3
+
navTitle: CVE-2020-10531
4
+
affectedProducts: All versions of EDB Postgres Advanced Server from 13 through 16
5
+
---
6
+
7
+
First Published: 2024/11/14
8
+
9
+
Last Updated: 2024/11/14
10
+
11
+
## Important
12
+
13
+
This is an assessment of the impact of CVE-2020-10531 on EDB products and services. It links to and details the CVE and supplements that information with EDB's own assessment.
14
+
15
+
## Summary
16
+
17
+
The original vulnerability was an integer overflow leading to a heap-based buffer overflow in `UnicodeString::doAppend()` in ICU (International Components for Unicode) for C/C++ which existed up to (and including) version 66.1.
18
+
19
+
In the process of validating EDB Postgres Advanced Server 17, a release check identified the presence of a pre 67.1 version of the library being used.
20
+
21
+
It had been believed that existing versions of EPAS had been built with a later library version.
22
+
23
+
While most EDB software builds against the operating system provided version of ICU, EDB Postgres Advanced Server can include EDB’s own build of ICU 66.1, specifically on RHEL7 on x86\_64/PPCLE, RHEL8 on x86\_64/PPCLE, SLES 12 x86\_64/PPCLE/s390x, and SLES 15 x86\_64/PPCLE/s390x. On RHEL9, the OS supplied library (version 67.1) is used.
24
+
25
+
EDB Postgres Extended and Postgres use the OS supplied ICU libraries, and are not affected by this vulnerability.
26
+
27
+
It has been established that EDB’s code does not use the vulnerable function.
28
+
Assessment and mitigation: In the interests of ensuring that the vulnerable library doesn’t provide any surface for an attacker, we are releasing updated versions of all affected products.
This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document is at your own risk. EDB reserves the right to change or update this document at any time. Customers are therefore recommended to always view the latest version of this document.
<h5> All versions of EDB Postgres Advanced Server from 13 through 16</h5>
37
38
</summary>
38
39
<hr/>
39
40
<em>Summary:</em>
40
-
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.
41
+
The original vulnerability was an integer overflow leading to a heap-based buffer overflow in <code>UnicodeString::doAppend()</code> in ICU (International Components for Unicode) for C/C++ which existed up to (and including) version 66.1.
<h5> PostgreSQL, EPAS all versions prior to 15.6.0,14.11.0,13.14.20 and 12.18.23, PGE all versions prior to 15.6.0</h5>
56
57
</summary>
57
58
<hr/>
58
59
<em>Summary:</em>
59
-
Missing authorization in PostgreSQL built-in views <code>pg_stats_ext</code> and <code>pg_stats_ext_exprs</code> allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes, which are provided as a convenience in the below section. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.
60
+
Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. As part of exploiting this vulnerability, the attacker creates functions that use CREATE RULE to convert the internally-built temporary table to a view. Versions before PostgreSQL 15.6, 14.11, 13.14, and 12.18 are affected. The only known exploit does not work in PostgreSQL 16 and later. For defense in depth, PostgreSQL 16.2 adds the protections that older branches are using to fix their vulnerability.
60
61
<br/>
61
-
<ahref="cve-2024-4317">Read More...</a>
62
+
<ahref="cve-2024-0985">Read More...</a>
62
63
</details></td></tr>
63
64
64
65
@@ -85,18 +86,37 @@ pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using Prefe
<h4>Restrict visibility of "pg_stats_ext" and "pg_stats_ext_exprs" entries to the table owner</h4>
94
+
<h5> All versions of PostgreSQL, EPAS and PGE prior to 16.3, 15.7, and 14.12</h5>
94
95
</summary>
95
96
<hr/>
96
97
<em>Summary:</em>
97
-
Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. As part of exploiting this vulnerability, the attacker creates functions that use CREATE RULE to convert the internally-built temporary table to a view. Versions before PostgreSQL 15.6, 14.11, 13.14, and 12.18 are affected. The only known exploit does not work in PostgreSQL 16 and later. For defense in depth, PostgreSQL 16.2 adds the protections that older branches are using to fix their vulnerability.
98
+
Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes, which are provided as a convenience in the below section. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.
<h4>PostgreSQL relation replacement during pg_dump executes arbitrary SQL</h4>
113
+
<h5> All versions of PostgreSQL, EPAS and PGE prior to 16.4, 15.8, and 14.13</h5>
114
+
</summary>
115
+
<hr/>
116
+
<em>Summary:</em>
117
+
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.
<h5> All versions of EDB Postgres Advanced Server from 13 through 16</h5>
64
64
</summary>
65
65
<hr/>
66
66
<em>Summary:</em>
67
-
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.
67
+
The original vulnerability was an integer overflow leading to a heap-based buffer overflow in <code>UnicodeString::doAppend()</code> in ICU (International Components for Unicode) for C/C++ which existed up to (and including) version 66.1.
<h5> PostgreSQL, EPAS all versions prior to 15.6.0,14.11.0,13.14.20 and 12.18.23, PGE all versions prior to 15.6.0</h5>
80
80
</summary>
81
81
<hr/>
82
82
<em>Summary:</em>
83
-
Missing authorization in PostgreSQL built-in views <code>pg_stats_ext</code> and <code>pg_stats_ext_exprs</code> allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes, which are provided as a convenience in the below section. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.
83
+
Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. As part of exploiting this vulnerability, the attacker creates functions that use CREATE RULE to convert the internally-built temporary table to a view. Versions before PostgreSQL 15.6, 14.11, 13.14, and 12.18 are affected. The only known exploit does not work in PostgreSQL 16 and later. For defense in depth, PostgreSQL 16.2 adds the protections that older branches are using to fix their vulnerability.
<h4>Restrict visibility of "pg_stats_ext" and "pg_stats_ext_exprs" entries to the table owner</h4>
111
+
<h5> All versions of PostgreSQL, EPAS and PGE prior to 16.3, 15.7, and 14.12</h5>
112
112
</summary>
113
113
<hr/>
114
114
<em>Summary:</em>
115
-
Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. As part of exploiting this vulnerability, the attacker creates functions that use CREATE RULE to convert the internally-built temporary table to a view. Versions before PostgreSQL 15.6, 14.11, 13.14, and 12.18 are affected. The only known exploit does not work in PostgreSQL 16 and later. For defense in depth, PostgreSQL 16.2 adds the protections that older branches are using to fix their vulnerability.
115
+
Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes, which are provided as a convenience in the below section. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.
<h4>PostgreSQL relation replacement during pg_dump executes arbitrary SQL</h4>
127
+
<h5> All versions of PostgreSQL, EPAS and PGE prior to 16.4, 15.8, and 14.13</h5>
128
+
</summary>
129
+
<hr/>
130
+
<em>Summary:</em>
131
+
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.
0 commit comments