CVE-2014-0060

Overview

CVE-2014-0060 (PostgreSQL security bypass vulnerability)

  • Posted March 4, 2014

  • Assessed Risk Level: Medium

PostgreSQL did not properly enforce the WITH ADMIN OPTION permission for role management, which allowed any member of a role the ability to grant others access to the same role regardless if the member was given the WITH ADMIN OPTION permission. For more details please see: http://wiki.postgresql.org/wiki/20140220securityrelease#SET_ROLE_bypasses_lack_of_ADMIN_OPTION

Status

  • Affected Versions: Puppet Enterprise 3.x
  • Resolved in Puppet Enterprise 3.2.0