aiven-extras up to 1.1.8 input validation

Summaryinfo

A vulnerability marked as problematic has been reported in aiven-extras up to 1.1.8. The impacted element is an unknown function. Performing a manipulation results in an unknown weakness. This vulnerability is cataloged as CVE-2023-32305. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in aiven-extras up to 1.1.8. It has been classified as problematic. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers on privileged functions called by the aiven-extras extension. A low privileged user can create objects that collide with existing function names, which will then be executed instead. Exploiting this vulnerability could allow a low privileged user to acquire `superuser` privileges, which would allow full, unrestricted access to all data and database functions. And could lead to arbitrary code execution or data access on the underlying host as the `postgres` user. The issue has been patched as of version 1.1.9.

The weakness was shared 05/13/2023 as GHSA-7r4w-fw4h-67gp. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2023-32305 since 05/08/2023. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.1.9 eliminates this vulnerability. Applying the patch 8682ae01bec0791708bf25791786d776e2fb0250 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• aiven-extras

Version

• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.5
• 1.1.6
• 1.1.7
• 1.1.8

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion