PT-2023-7471 · Unknown · Greenplum Database

Publicado 2023-05-15 · Atualizado 2023-05-25 · CVE-2023-31131

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Greenplum Database versions prior to 6.22.3

Description The issue is related to the Greenplum Database using unsafe methods to extract tar files within GPPKGs, leading to path traversal and arbitrary file writes. An attacker can exploit this to overwrite data or system files, potentially causing a system crash or malfunction. Any files accessible to the running process are at risk.

Recommendations For Greenplum Database versions prior to 6.22.3, upgrade to Greenplum Database version 6.23.2 or higher. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation. Note that there are no known workarounds for this issue other than upgrading to a patched version.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-08515

CVE-2023-31131

GHSA-HGM9-2Q42-C7F3

Produtos afetados

Greenplum Database

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31131.json · Exploit
• https://t.me/cibsecurity/64181 · Publicação no Telegram
• https://vuldb.com/?id.229091 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-31131 · Nota de Segurança
• https://t.me/cvenotify/50508 · Publicação no Telegram
• ❌ https://github.com/greenplum-db/gpdb/security/advisories/GHSA-hgm9-2q42-c7f3 · Aviso do Fabricante, Deleted
• https://osv.dev/vulnerability/CVE-2023-31131 · Aviso do Fabricante
• ❌ https://github.com/greenplum-db/gpdb/commit/1ec4affbba7c9745f64edbd80a6680ad29b09471 · Correção, Deleted
• https://bdu.fstec.ru/vul/2023-08515 · Nota de Segurança