PT-2024-2087 · Unknown · Postgresql Anonymizer

Published 2024-03-08 · Updated 2024-03-08 · CVE-2024-2338

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PostgreSQL Anonymizer version 1.2

Description The issue is related to a SQL injection vulnerability in PostgreSQL Anonymizer. This vulnerability allows a user who owns a table to elevate their privileges to superuser when dynamic masking is enabled. The problem arises from a flaw that permits complex expressions to be provided as a value, which is later used to create masked views, leading to SQL injection. If dynamic masking is enabled, this results in privilege escalation to superuser after the label is created. Users who do not own a table, especially masked users, cannot exploit this vulnerability.

Recommendations For PostgreSQL Anonymizer version 1.2, update to version 1.3 to resolve the issue. As a temporary workaround, consider disabling dynamic masking until the update is applied. Restrict access to table ownership to minimize the risk of exploitation. Avoid using complex expressions as values for security labels until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-01983

CVE-2024-2338

Affected Products

Postgresql Anonymizer

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-2338 · Security Note
• https://gitlab.com/dalibo/postgresql_anonymizer/-/commit/f55daadba3fa8226029687964aa8889d01a79778 · Patch
• https://bdu.fstec.ru/vul/2024-01983 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2338 · Vendor Advisory
• https://t.me/cvenotify/73404 · Telegram Post
• https://twitter.com/CVEnew/status/1766196318907822304 · Twitter Post
• https://security.snyk.io/vuln/SNYK-UNMANAGED-DALIBOPOSTGRESQLANONYMIZER-6421111 · Note