public inbox for [email protected]
help / color / mirror / Atom feedFrom: Khushboo Vashi <[email protected]>
To: Qasim Tahir <[email protected]>
Cc: Dave Page <[email protected]>
Cc: Akshay Joshi <[email protected]>
Cc: pgadmin-hackers <[email protected]>
Subject: Re: Potential Security Issue: Permissions in PgAdmin Installation Directory
Date: Mon, 10 Jun 2024 15:35:29 +0530
Message-ID: <CAFOhELde6TetVVtdVKkc616CoFeMPKbK7qdiwa5OkumiveGEqg@mail.gmail.com> (raw)
In-Reply-To: <CAG=GPUMVVBDCQdCZKxU_6DB3mkUMFEUB9Uh485Ui2qQHYh=SCw@mail.gmail.com>
References: <CAG=GPUPva4=hFdQNGwke2auE6sL0kVW6hb2bSxbWE4xdtWe93A@mail.gmail.com>
<CA+OCxoxsLdYma3VyceBims-=yTx7VfixLHPEqm3ULbTABcTmTQ@mail.gmail.com>
<CAG=GPUN5qerRQY87wRe2sdN0RHhZAmNGkANi5=6_Ds5tVX+tXw@mail.gmail.com>
<CA+OCxoz6CQzKbrjhWOtUQYk=K8feBk3YnQdp7sYcmR-XqynaLQ@mail.gmail.com>
<CAFOhELdbXmgxu6D783FS3rGFER2A71He8XZM95tvMome=uYGaw@mail.gmail.com>
<CAG=GPUMVVBDCQdCZKxU_6DB3mkUMFEUB9Uh485Ui2qQHYh=SCw@mail.gmail.com>
On Mon, Jun 10, 2024 at 3:18 PM Qasim Tahir <[email protected]>
wrote:
> Hi Everyone,
>
> Any update regarding the issue.
>
We are working on this issue and it will be available in the next release,
scheduled at the end of June.
>
> Thanks
> Qasim
>
> On Mon, Jun 3, 2024 at 10:46 AM Khushboo Vashi <
> [email protected]> wrote:
>
>>
>>
>> On Sat, Jun 1, 2024 at 8:34 PM Dave Page <[email protected]> wrote:
>>
>>> Akshay, could you or one of the team look into this please?
>>>
>> I am looking into this issue
>>
>>>
>>> Thanks.
>>>
>>> On Fri, 31 May 2024 at 23:27, Qasim Tahir <[email protected]>
>>> wrote:
>>>
>>>> Hi,
>>>> Platform and package details are below
>>>>
>>>> Platform: *Rocky 8.9*
>>>> *pgadmin *version*: 8.7*
>>>>
>>>> Regards
>>>> Qasim
>>>>
>>>> On Sat, Jun 1, 2024 at 3:09 AM Dave Page <[email protected]> wrote:
>>>>
>>>>> Hi
>>>>>
>>>>> On Thu, 30 May 2024 at 23:17, Qasim Tahir <[email protected]>
>>>>> wrote:
>>>>>
>>>>>> Dear PgAdmin Community,
>>>>>>
>>>>>> I am writing to report a potential security issue with the
>>>>>> permissions set in the PgAdmin installation directory.
>>>>>>
>>>>>> After installing PgAdmin, I observed that several directories,
>>>>>> including 'bin', 'venv', and 'web', have 775 permissions. Here are the
>>>>>> details of the directory permissions:
>>>>>> [image: image.png]
>>>>>>
>>>>>> Given the broad access provided by 775 permissions, there is a
>>>>>> concern about the potential for unauthorized access or modifications.
>>>>>>
>>>>>>
>>>>>> I would like to ask if these permissions are necessary for PgAdmin's
>>>>>> operation or if they could be tightened to enhance security.
>>>>>>
>>>>>> Your guidance on this matter would be greatly appreciated.
>>>>>>
>>>>>> Thank you for your attention to this issue.
>>>>>>
>>>>>
>>>>> What platform and package is this exactly?
>>>>>
>>>>> --
>>>>> Dave Page
>>>>> pgAdmin: https://www.pgadmin.org
>>>>> PostgreSQL: https://www.postgresql.org
>>>>> EDB: https://www.enterprisedb.com
>>>>>
>>>>>
>>>
>>> --
>>> Dave Page
>>> pgAdmin: https://www.pgadmin.org
>>> PostgreSQL: https://www.postgresql.org
>>> EDB: https://www.enterprisedb.com
>>>
>>>
Attachments:
[image/png] image.png (23.8K, 3-image.png)
download | view image
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected], [email protected], [email protected]
Subject: Re: Potential Security Issue: Permissions in PgAdmin Installation Directory
In-Reply-To: <CAFOhELde6TetVVtdVKkc616CoFeMPKbK7qdiwa5OkumiveGEqg@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox