public inbox for [email protected]  

help / color / mirror / Atom feed
From: Usman Khan <[email protected]>
To: Dave Page <[email protected]>
To: [email protected]
Subject: Re: Potential Security Issue: Permissions in PgAdmin Installation Directory
Date: Sun, 2 Jun 2024 14:27:55 +0500
Message-ID: <CANVC+RF0m_YhGwfdCQP1nPoriDWaX_+Juphe=koHQiKRt2QvzQ@mail.gmail.com> (raw)
In-Reply-To: <CA+OCxoxsLdYma3VyceBims-=yTx7VfixLHPEqm3ULbTABcTmTQ@mail.gmail.com>
References: <CAG=GPUPva4=hFdQNGwke2auE6sL0kVW6hb2bSxbWE4xdtWe93A@mail.gmail.com>
	<CA+OCxoxsLdYma3VyceBims-=yTx7VfixLHPEqm3ULbTABcTmTQ@mail.gmail.com>

On Sat, Jun 1, 2024 at 3:09 AM Dave Page <[email protected]> wrote:

> Hi
>
> On Thu, 30 May 2024 at 23:17, Qasim Tahir <[email protected]>
> wrote:
>
>> Dear PgAdmin Community,
>>
>> I am writing to report a potential security issue with the permissions
>> set in the PgAdmin installation directory.
>>
>> After installing PgAdmin, I observed that several directories, including
>> 'bin', 'venv', and 'web', have 775 permissions. Here are the details of the
>> directory permissions:
>> [image: image.png]
>>
>> Given the broad access provided by 775 permissions, there is a concern
>> about the potential for unauthorized access or modifications.
>>
>>
>> I would like to ask if these permissions are necessary for PgAdmin's
>> operation or if they could be tightened to enhance security.
>>
>> Your guidance on this matter would be greatly appreciated.
>>
>> Thank you for your attention to this issue.
>>
>
> What platform and package is this exactly?
>
FYI - this behaviour is reproducible on ubuntu 22.04 and rockey 8.9 with
the latest installers for me.

*ubuntu 22.04*

[image: image.png]

*rockey 8.9 - installed through guidance on this link *
https://www.pgadmin.org/download/pgadmin-4-rpm/

[image: image.png]





> --
> Dave Page
> pgAdmin: https://www.pgadmin.org
> PostgreSQL: https://www.postgresql.org
> EDB: https://www.enterprisedb.com
>
>


Attachments:

  [image/png] image.png (23.8K, 3-image.png)
  download | view image

  [image/png] image.png (144.2K, 4-image.png)
  download | view image

  [image/png] image.png (186.7K, 5-image.png)
  download | view image

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: Potential Security Issue: Permissions in PgAdmin Installation Directory
  In-Reply-To: <CANVC+RF0m_YhGwfdCQP1nPoriDWaX_+Juphe=koHQiKRt2QvzQ@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox