From owner-dev-commits-ports-all@freebsd.org Sun Jun 6 20:51:04 2021 Return-Path: Delivered-To: dev-commits-ports-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 4DF4D63D877; Sun, 6 Jun 2021 20:51:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FypZ01pflz3wJb; Sun, 6 Jun 2021 20:51:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 271FE207E; Sun, 6 Jun 2021 20:51:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 156Kp4xZ061464; Sun, 6 Jun 2021 20:51:04 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 156Kp4wD061463; Sun, 6 Jun 2021 20:51:04 GMT (envelope-from git) Date: Sun, 6 Jun 2021 20:51:04 GMT Message-Id: <202106062051.156Kp4wD061463@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Matthew Seaman Subject: git: ef3b8b2cfe59 - main - security/vuxml: Document CVE-2021-3515 for databases/pglogical MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: matthew X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: ef3b8b2cfe595e9d2ade55206497199382ef6046 Auto-Submitted: auto-generated X-BeenThere: dev-commits-ports-all@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for all branches of the ports repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Jun 2021 20:51:04 -0000 The branch main has been updated by matthew: URL: https://cgit.FreeBSD.org/ports/commit/?id=ef3b8b2cfe595e9d2ade55206497199382ef6046 commit ef3b8b2cfe595e9d2ade55206497199382ef6046 Author: Matthew Seaman AuthorDate: 2021-06-06 20:48:56 +0000 Commit: Matthew Seaman CommitDate: 2021-06-06 20:48:56 +0000 security/vuxml: Document CVE-2021-3515 for databases/pglogical A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. An attacker with CREATEDB privileges on a PostgreSQL server can craft a database name that allows execution of shell commands as the postgresql user when calling pglogical.create_subscription(). --- security/vuxml/vuln.xml | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index b6a438010fe1..3addf0844167 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -76,6 +76,43 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + pglogical -- shell command injection in pglogical.create_subscription() + + + pglogical + 2.3.4 + + + + +

2ndQuadrant reports:

+
+
    +
  • + Fix pg_dump/pg_restore execution (CVE-2021-3515)
    +
    + Correctly escape the connection string for both pg_dump + and pg_restore so that exotic database and user names are + handled correctly.
    +
    + Reported by Pedro Gallegos +
    • +
+
+ + + + CVE-2021-3515 + https://github.com/2ndQuadrant/pglogical/releases/tag/REL2_3_4 + https://bugzilla.redhat.com/show_bug.cgi?id=1954112 + + + 2021-06-01 + 2021-06-06 + + + drupal7 -- fix possible CSS