{"id":119252,"date":"2024-08-09T15:43:07","date_gmt":"2024-08-09T13:43:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-sql-kod-s-pravami-polzovatelya-zapuskayushhego-pg_dump"},"modified":"2024-08-09T15:43:07","modified_gmt":"2024-08-09T13:43:07","slug":"uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-sql-kod-s-pravami-polzovatelya-zapuskayushhego-pg_dump","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-sql-kod-s-pravami-polzovatelya-zapuskayushhego-pg_dump","title":{"rendered":"PostgreSQL haavatavus, mis v\u00f5imaldab t\u00e4ita SQL-koodi kasutaja \u00f5igustes, kes k\u00e4ivitab pg_dump","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

PostgreSQL versioonide 16.4, 15.8, 14.13, 13.16, 12.20 toetatavate harude jaoks on v\u00e4lja antud parandusteadetega uuendused, mis lahendavad 56 viimase kolme kuu jooksul tuvastatud viga. Uutes versioonides on muu hulgas k\u00f5rvaldatud haavatavus (CVE-2024-7348), mis on m\u00e4rgitud ohtlikuks (ohtu tase 8.8 skaalal 10). Haavatavus on p\u00f5hjustatud v\u00f5istlusolukorrast utiliidis pg_dump, mis v\u00f5imaldab r\u00fcndajal, kellel on \u00f5igused luua ja kustutada p\u00fcsivaid objekte andmebaasis, saavutada suvalise SQL-koodi t\u00e4itmine sellega kasutaja \u00f5igustes, mida kasutatakse pg_dump'i k\u00e4ivitamiseks (tavaliselt k\u00e4ivitatakse pg_dump superkasutaja \u00f5igustes andmebaasi varukoopiate tegemiseks). <\/p>\n

Edukate r\u00fcnnaku jaoks on vajalik j\u00e4lgida pg_dump utiliidi k\u00e4ivitamise hetke, mida saab h\u00f5lpsasti teostada avatud tehingu kaudu manipuleerimisega. R\u00fcnnak seisneb j\u00e4rjestuse (sequence) asendamises vaate v\u00f5i v\u00e4lise tabeliga, mis m\u00e4\u00e4ravad k\u00e4ivitatava SQL-koodi, pg_dump'i k\u00e4ivitamise hetkel, kui teave j\u00e4rjestuse olemasolu kohta on juba saadud, kuid andmed pole veel v\u00e4lja toodud. Turvan\u00f5rkuse blokeerimiseks on lisatud seadistus «restrict_nonsystem_relation_kind», mis keelab mitte-s\u00fcsteemsete vaadete ja v\u00e4liste tabelite avamise pg_dump'is.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 16.4, 15.8, 14.13, 13.16, 12.20, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e 56 \u043e\u0448\u0438\u0431\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0442\u0440\u0438 \u043c\u0435\u0441\u044f\u0446\u0430. \u0421\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e \u0432 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-7348), \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u043d\u0430\u044f \u043a\u0430\u043a \u043e\u043f\u0430\u0441\u043d\u0430\u044f (\u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 8.8 \u0438\u0437 10). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c \u0433\u043e\u043d\u043a\u0438 \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 pg_dump, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u043c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443, \u0438\u043c\u0435\u044e\u0449\u0435\u043c\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0445 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119252","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 PostgreSQL haavatavus, mis v\u00f5imaldab t\u00e4ita SQL-koodi kasutaja \u00f5igustega, kes k\u00e4ivitab pg_dump | ProHoster","description":"On loodud parandavad v\u00e4rskendused k\u00f5igi toetatud PostgreSQL versioonide jaoks: 16.4, 15.8, 14.13, 13.16, 12.20, kus on parandatud 56 viga, mis tuvastati viimase kolme kuu jooksul. Uutes versioonides on muu hulgas k\u00f5rvaldatud haavatavus (CVE-2024-7348), mis on m\u00e4rgitud ohtlikuks (ohu tase 8.8 10-st). Haavatavus on p\u00f5hjustatud v\u00f5istlusolukorrast pg_dump utiliidis, mis v\u00f5imaldab r\u00fcndajal, kes omab \u00f5igust luua ja kustutada p\u00fcsivaid objekte.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-sql-kod-s-pravami-polzovatelya-zapuskayushhego-pg_dump","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 PostgreSQL, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c SQL-\u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0433\u043e pg_dump | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 16.4, 15.8, 14.13, 13.16, 12.20, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e 56 \u043e\u0448\u0438\u0431\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0442\u0440\u0438 \u043c\u0435\u0441\u044f\u0446\u0430. \u0421\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e \u0432 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-7348), \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u043d\u0430\u044f \u043a\u0430\u043a \u043e\u043f\u0430\u0441\u043d\u0430\u044f (\u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 8.8 \u0438\u0437 10). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c \u0433\u043e\u043d\u043a\u0438 \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 pg_dump, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u043c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443, \u0438\u043c\u0435\u044e\u0449\u0435\u043c\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0445 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-postgresql-pozvolyayushhaya-vypolnit-sql-kod-s-pravami-polzovatelya-zapuskayushhego-pg_dump","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-08-09T13:43:07+00:00","article:modified_time":"2024-08-09T13:43:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119252","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 05:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 05:39:19","updated":"2026-01-23 05:39:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=119252"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119252\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=119252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=119252"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=119252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}