PT-2021-4271 · Pglogical · Pglogical

Pedro Sampaio · Published 2021-05-18 · Updated 2022-10-07 · CVE-2021-3515

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pglogical versions before 2.3.4 pglogical versions before 3.6.26

Description The issue is related to a lack of input data sanitization in the pglogical system, which can be exploited to gain access to confidential data, compromise data integrity, and cause a denial of service. An attacker with CREATEDB privileges on a PostgreSQL server can craft a database name to execute shell commands as the postgresql user when calling pglogical.create subscription().

Recommendations For versions before 2.3.4, update to version 2.3.4 or later. For versions before 3.6.26, update to version 3.6.26 or later. As a temporary workaround, consider restricting the CREATEDB privileges on the PostgreSQL server to minimize the risk of exploitation. Avoid using the pglogical.create subscription() function with untrusted database names until the issue is resolved.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2021-04879

CVE-2021-3515

Affected Products

Pglogical

References · 11

• https://cve.org/CVERecord?id=CVE-2021-3515 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3515 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3515 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04879 · Security Note
• https://ubuntu.com/security/CVE-2021-3515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3515 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1954112 · Patch
• https://osv.dev/vulnerability/CVE-2021-3515 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3515 · Vendor Advisory
• https://github.com/2ndQuadrant/pglogical/commit/95c0e8981485e09efab6821cf55a4e27b086efe5 · Note
• https://t.me/cvenotify/16260 · Telegram Post