public inbox for [email protected]  

help / color / mirror / Atom feed

From: Qasim Tahir <[email protected]>
To: Khushboo Vashi <[email protected]>
Cc: Dave Page <[email protected]>
Cc: Akshay Joshi <[email protected]>
Cc: pgadmin-hackers <[email protected]>
Subject: Re: Potential Security Issue: Permissions in PgAdmin Installation Directory
Date: Mon, 10 Jun 2024 14:48:31 +0500
Message-ID: <CAG=GPUMVVBDCQdCZKxU_6DB3mkUMFEUB9Uh485Ui2qQHYh=SCw@mail.gmail.com> (raw)
In-Reply-To: <CAFOhELdbXmgxu6D783FS3rGFER2A71He8XZM95tvMome=uYGaw@mail.gmail.com>
References: <CAG=GPUPva4=hFdQNGwke2auE6sL0kVW6hb2bSxbWE4xdtWe93A@mail.gmail.com>
	<CA+OCxoxsLdYma3VyceBims-=yTx7VfixLHPEqm3ULbTABcTmTQ@mail.gmail.com>
	<CAG=GPUN5qerRQY87wRe2sdN0RHhZAmNGkANi5=6_Ds5tVX+tXw@mail.gmail.com>
	<CA+OCxoz6CQzKbrjhWOtUQYk=K8feBk3YnQdp7sYcmR-XqynaLQ@mail.gmail.com>
	<CAFOhELdbXmgxu6D783FS3rGFER2A71He8XZM95tvMome=uYGaw@mail.gmail.com>

Hi Everyone,

Any update regarding the issue.

Thanks
Qasim

On Mon, Jun 3, 2024 at 10:46 AM Khushboo Vashi <
[email protected]> wrote:

>
>
> On Sat, Jun 1, 2024 at 8:34 PM Dave Page <[email protected]> wrote:
>
>> Akshay, could you or one of the team look into this please?
>>
> I am looking into this issue
>
>>
>> Thanks.
>>
>> On Fri, 31 May 2024 at 23:27, Qasim Tahir <[email protected]>
>> wrote:
>>
>>> Hi,
>>> Platform and package details are below
>>>
>>> Platform: *Rocky 8.9*
>>> *pgadmin *version*:  8.7*
>>>
>>> Regards
>>> Qasim
>>>
>>> On Sat, Jun 1, 2024 at 3:09 AM Dave Page <[email protected]> wrote:
>>>
>>>> Hi
>>>>
>>>> On Thu, 30 May 2024 at 23:17, Qasim Tahir <[email protected]>
>>>> wrote:
>>>>
>>>>> Dear PgAdmin Community,
>>>>>
>>>>> I am writing to report a potential security issue with the permissions
>>>>> set in the PgAdmin installation directory.
>>>>>
>>>>> After installing PgAdmin, I observed that several directories,
>>>>> including 'bin', 'venv', and 'web', have 775 permissions. Here are the
>>>>> details of the directory permissions:
>>>>> [image: image.png]
>>>>>
>>>>> Given the broad access provided by 775 permissions, there is a concern
>>>>> about the potential for unauthorized access or modifications.
>>>>>
>>>>>
>>>>> I would like to ask if these permissions are necessary for PgAdmin's
>>>>> operation or if they could be tightened to enhance security.
>>>>>
>>>>> Your guidance on this matter would be greatly appreciated.
>>>>>
>>>>> Thank you for your attention to this issue.
>>>>>
>>>>
>>>> What platform and package is this exactly?
>>>>
>>>> --
>>>> Dave Page
>>>> pgAdmin: https://www.pgadmin.org
>>>> PostgreSQL: https://www.postgresql.org
>>>> EDB: https://www.enterprisedb.com
>>>>
>>>>
>>
>> --
>> Dave Page
>> pgAdmin: https://www.pgadmin.org
>> PostgreSQL: https://www.postgresql.org
>> EDB: https://www.enterprisedb.com
>>
>>


Attachments:

  [image/png] image.png (23.8K, 3-image.png)
  download | view image

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected], [email protected]
  Subject: Re: Potential Security Issue: Permissions in PgAdmin Installation Directory
  In-Reply-To: <CAG=GPUMVVBDCQdCZKxU_6DB3mkUMFEUB9Uh485Ui2qQHYh=SCw@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox