Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1s6vhk-002XAz-4o for pgsql-bugs@arkaria.postgresql.org; Tue, 14 May 2024 17:12:45 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1s6vhk-00097r-2L for pgsql-bugs@arkaria.postgresql.org; Tue, 14 May 2024 17:12:44 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1s6ura-00H8NX-Vk for pgsql-bugs@lists.postgresql.org; Tue, 14 May 2024 16:18:51 +0000 Received: from sonic305-21.consmr.mail.ne1.yahoo.com ([66.163.185.147]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1s6urT-000BUo-Mz for pgsql-bugs@lists.postgresql.org; Tue, 14 May 2024 16:18:49 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1715703522; bh=AQDJ81ZzAMcZ7ji+cXZzvXawhUPROAvwMPJaDOBYLPI=; h=Date:From:To:Subject:References:From:Subject:Reply-To; b=C6Bg4Y/awoJIp8BNROkEEkiIXC5u/1CTSys9B0v8Th9i8iZs/d+75v3fguFDAiRXQs83twC0gfon7iaFv+E/D8ePoFfFHA6Cunl4rCBxsE8ugIFf53Z8lASP/U2DNu7IZxqcJt3ou+Bly/ku/mxWVNPFQSs2OxTd3E6eycYhnSNtRhHDaW8DDUl1LNKkpR7NrE5mxwetR7eB92Khw0/eQD7u71rBFcARCX8Sv6tVyEzKelWXnRqvc1sdXz3f55PVOg9Chsd2O14jDBqoAu0J8JGHcXgIxz+/v1gXnDLiG9vx9Z0U8bEggcjV37IHy7a2TkOSeUhWWYpWFOngOtp2Vg== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1715703522; bh=chv0y8241mgD3VTEJ4c0zT6HfjibfXaEdoE6TsjQ6Ip=; h=X-Sonic-MF:Date:From:To:Subject:From:Subject; b=HA1+UC0cHNeRHrJ02WqKPYnIsup3L6NmFoetjJsyItBLcvX+MI1d7T2tIr+hi6wfvTJ90ioqh7/5Uma1xggEirPhzbv/PVV1TeHUNS5tYnwukHApZb1409TZV7FuXuzhGYXFG3xhPqVG0ayzW/PPmFRNWjzwCvfxgGz0isS+WOzZ4MN9Vu573PbRCatohQ7GJx9C7245kPCLvdfp01mEi18nd3x15HozsxyQi5xv6P8Gx8FZR+btQOKUr580kp6jnLPd4m7Kx8EGY4AcCVKuKmrkrdxlMtgXI4FAx73bp00pRwMuNBi4QnvurmoVQ/S6yhM4d5ogwR1MGag02TekhQ== X-YMail-OSG: FcZlxBkVM1kJjWR.l8SUgahf_ZfU6ABAAQv09Xaz_1.x5yUgi0hSN7zODaEyKOM XBDMwAA9CR.dFy.J2x2VgbqOmyYrJlCI.tpMc4x5DYdyvL2c0MgkXHXiwqmm0vYiwCul4nq2A42s n0U_7Xk8ZQhBBofLswiGY8C8UtHjHkOGtifHe8nir7Gort_vurnUCWIJ2Kq9ThWshJ6lBnSt45zH _O.VClJ0uNSayk5CbcGjjxNsXhkwDX6rzwE074BuW4oHPJ7pYYGaUd8ZeyIPL1f9sfKyuobIaMvy H2FtUxO3X6GW.744S8cvAA88uZSGojF1zH4E6svMJN333wz6uqzdmPt32bVkcL5l7uQzAOlcrzZD qynvzxdrdpJ.6tXvQF9vAbjhWZCZUsR1o12Q3LUHOdaP6A.89g8_x9Ivb9EUIuUbfO0IVSy3ApKa hgCM2BMSVy1U36YxFPmPJnnuLkkQS_bbHA5QI4ew16S9gCDBmV0Mi9NwoT1rj52JOuX_FCtsfwKp 3zpaX_URW3Ma.DcCzENanj3vUNiA2D9yPUFJ1qlHezGtXMI4TEzgsNk6vD0mWV_6HQ8PIPF0dMh9 gEf6Btd2s_J.1RRH0n_hkS9UFxzcIPgD4nOPNLaepJHQZA0C4tq_4rHMjrzmhNFuTZ5jXsaXx7OL XPUUFiQmLSf9EF_iFHfdGXJaZuki5bwySwP.P57dSJKO5NV7i3F3lAYZob.g.B7ezGW3BC3NzPQE uVbsCfgpvjTD0RfQfBSc53xuujhGaAtmtj5L0JHA4Fx0N.kGme42jocKzYD.h2H3dQZHUH3.1hA5 WBigRRUokCTRy7HJVcOR15PPltGKAdmXnzMpRpMkuPlUV.IXSdni17kJubSKrE1gFw5VzyKs8zgH Mo4tLBh2EKo6cyNozUL_7pwCauWSZ0rUfAEFcDoejPllYrguEczb6rQFrlGceFCpEc_e1ZGKtL5K I9ZdWxt.NJstkMevMYIQPXuxzzaG9tBp7BcZQsbjejkllYlR0Lg7E9gFHIU9JHG.B.3vZhkYK20E 8QTGBt9ZQcLj_2QMPK8mlmiehuSGtsDhkVxR9wFMP2HW7mDs1j.pQz.IzTg7M521Pia3HrAQNgG8 PiJUdztcoV76Ks.nxP26gjRlHFy.zR0i_ejbs.zwJlK4roMNf4Gk0eonpz4UNuXCZCVM684oUYQn lIC6KOSzYgU9SyU.f56xtI6VAbqzSOc5fZNTCsZQ9wJBZb6Y95STWwo8qg17cqO3P5nposmnse9L HBMz449l9dxC.G4ac7dDqIAY9EUQgpQGdZ7GXKDUiWAmWmNtJtMU3ZSMa_ILpwW36eDC.fHNXae9 3SB0Z66yZp.Q0_d_Wzz.rCJ1JhRpwKxFwOLnEbpGa.Hrfr_UiXR.s9kZYrYPnD1803Pz9e150HfQ _ItNUJEqY5xP8sUFdn72YKxuqYcJPGcFoMX45a_zF4_dfdXPKQVbRPtzg311zbkjWLxMCU8TzyUM tfXJgVF7BMF9bPsYKYAZp8rMJlmDlec73XLppEIYku125yvkcJXWjOCLEmCbawWgh0dzzO2C0kDb ypYWHclblLPoOx3lSMJNfeS_Vxj5q44QbCzxwpItFM09irR9XIwvH.7f_X.ZSI5ODy1pTuusaw4f YiOv8JiZfRKguHt5JElra95kfw5MMkI3FDW.T7a4w2tsGeBCOwsiAKsLTpW_f7XjFvKp.GRh2AP0 TJK0uRuoOkJl4aVTB9z8a70oK6Mxq_kIG.q561_mhhLX7DJUtWzjM3orcECd9KIMRvYHahERVcbE 1ZEaxFe82ord2xY0JfXtc69tEaZ_by8CSXBGZV.CLBOKIfhCrUnApyz2.SeVpwvNm7R7vT5nMlQg ueowI_xolcuBRaVBTE8Nv02aKjEsqRiUefu.TJ8J6pAdQhZMh3aDVd4Phqq9OEUBa_3OeKmv0yXC Z6Cro2.jxQW.70HTm0UokJ1EDMKezSK6apdCzMP0K5QRU5V6PjDGtQs0lDn1qAmPQ0bFq0CSMYdq .A6yblYAjqc6bFurApT1OznL19TBi4PavSPUzmVlO6snIj1u3KrBM9qiKh8G3wP4rtIJJVOvHrTX 1hpfAybPVq0YAXNvH0MXF5yGrHq7u3Wuc32IeCrmFgj7oPkmC9N13c0s7rf65o5RVWuUKaGv333L 2rfMpywmpCJtacZkTYxZN4MM66CmIbvZM.ySL7LsK5K5SCR4bq1NpL_LBOjQoXdDZmF7hmypeg4r BVznzeYFSrJQqqqyhyK0huvlfJUzS2E0Ykbfs1QbW.Osp3RESSBTuU9w8QI3d5tGf X-Sonic-MF: X-Sonic-ID: 92a62e5c-4897-43b6-b854-02a0898bbb81 Received: from sonic.gate.mail.ne1.yahoo.com by sonic305.consmr.mail.ne1.yahoo.com with HTTP; Tue, 14 May 2024 16:18:42 +0000 Date: Tue, 14 May 2024 16:18:15 +0000 (UTC) From: emad al-mousa To: "pgsql-bugs@lists.postgresql.org" Message-ID: <2011067370.2392963.1715703495829@mail.yahoo.com> Subject: DoS Vulnerability MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_2392962_271121138.1715703495827" References: <2011067370.2392963.1715703495829.ref@mail.yahoo.com> X-Mailer: WebService/1.1.22321 YMailNorrin Content-Length: 7826 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk ------=_Part_2392962_271121138.1715703495827 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hello, In the documentation:=C2=A05.7. Privileges | | |=20 5.7. Privileges | =E2=80=9CFor other types of objects, the default privileges granted to PUBL= IC are as follows: CONNECT and TEMPORARY (create temporary tables) privileg= es for databases; EXECUTE privilege for functions and procedures; and USAGE= privilege for languages and data types (including domains). The object own= er can, of course, REVOKE both default and expressly granted privileges. (F= or maximum security, issue the REVOKE in the same transaction that creates = the object; then there is no window in which another user can use the objec= t.)=E2=80=9D by default any role/user in postgresql can connect to "ANY" database in the= cluster so even though the account can only connect, the account can still= create temporary object (for example temporary table). This table will be = created in the default database tablespace of the database associated with.= ..it will consume the space until it exhausts it....this means an applicati= on performing bulk write will face problems inserting data.=C2=A0keeping co= nnect permission by default granted to PUBLIC in PostgreSQL is opening a wi= de security hole that shouldn't exist in the first. I strongly believe this= should be patched and connect permission should be revoked from PUBLIC in = all databases and template1 database (the base database where DB's are crea= ted based on) account donald who is defined in pg_hba.conf file to authenticate against p= ostgres database as shown below, will be able t connect to "odsdb" database= and exhaust tablespace and cause Denial Of Service. $ /usr/pgsql-15/bin/psql -h localhost -U donald -d postgres -WPassword:psql= (15.6)SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, c= ompression: off)Type "help" for help. postgres=3D> \c odsdbPassword:SSL connection (protocol: TLSv1.3, cipher: TL= S_AES_256_GCM_SHA384, compression: off)You are now connected to database "o= dsdb" as user "donald".odsdb=3D> create temporary table tempo as select * f= rom generate_series(1,1000000000000000000000000000000000000);ERROR:=C2=A0 c= ould not write to file "pg_tblspc/16389/PG_15_202209061/pgsql_tmp/pgsql_tmp= 7557.7": No space left on device ------=_Part_2392962_271121138.1715703495827 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hello,

In the documentation: 5.7. Privileges




<= div>=E2=80=9CFor other types of objects, the default privileges grant= ed to PUBLIC are as follows: CONNECT and TEMPORARY (create temporary tables= ) privileges for databases; EXECUTE privilege for functions and procedures;= and USAGE privilege for languages and data types (including domains). The = object owner can, of course, REVOKE both default and expressly granted priv= ileges. (For maximum security, issue the REVOKE in the same transaction tha= t creates the object; then there is no window in which another user can use= the object.)=E2=80=9D

by default any role/user in postgresql can connect to "ANY" = database in the cluster so even though the account can only connect, the ac= count can still create temporary object (for example temporary table). This= table will be created in the default database tablespace of the database a= ssociated with...it will consume the space until it exhausts it....this mea= ns an application performing bulk write will face problems inserting data.&= nbsp;
keeping connect permission by default granted to PUBLIC in = PostgreSQL is opening a wide security hole that shouldn't exist in the firs= t. I strongly believe this should be patched and connect permission should = be revoked from PUBLIC in all databases and template1 database (the base da= tabase where DB's are created based on)

account donald who is defined in pg_hba.conf file t= o authenticate against postgres database as shown below, will be able t con= nect to "odsdb" database and exhaust tablespace and cause Denial Of Service= .

$ /usr/pgsql-15/bin/psql -h localhost -U donald = -d postgres -W
Password:
psql (15.6)
SSL conn= ection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off= )
Type "help" for help.

postgres=3D> = \c odsdb
Password:
SSL connection (protocol: TLSv1.3, c= ipher: TLS_AES_256_GCM_SHA384, compression: off)
You are now conn= ected to database "odsdb" as user "donald".
odsdb=3D> create t= emporary table tempo as select * from generate_series(1,1000000000000000000= 000000000000000000);
ERROR:  could not write to file "pg_tbl= spc/16389/PG_15_202209061/pgsql_tmp/pgsql_tmp7557.7": No space left on devi= ce

------=_Part_2392962_271121138.1715703495827--