Lucene search

K
rubygemsRubySecRUBY:PGSYNC-2021-31671
HistoryApr 25, 2021 - 9:00 p.m.

Connection security vulnerability with schema sync

2021-04-2521:00:00
RubySec
github.com
13
connection security vulnerability
schema sync
pgsync
ssl connection
parameter drop

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.003

Percentile

71.4%

pgsync drops connection parameters when syncing the schema with the
–schema-first and --schema-only options. Some of these parameters may
affect security. For instance, if sslmode is dropped, the connection
may not use SSL. The first connection parameter is not affected.

pgsync drops connection parameters when syncing the schema with the
--schema-first and --schema-only options. Some of these parameters
may affect security. For instance, if sslmode is dropped, the
connection may not use SSL. The first connection parameter is not affected.

An example where sslmode is dropped (connect_timeout is not affected):

from: postgres://user:pass@host/dbname?connect_timeout=10&sslmode=require

This applies to both the to and from connections.

Affected configurations

Vulners
Node
rubypgsyncRange0.6.7
VendorProductVersionCPE
rubypgsync*cpe:2.3:a:ruby:pgsync:*:*:*:*:*:*:*:*

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.003

Percentile

71.4%

Related for RUBY:PGSYNC-2021-31671