WarehousePG vulnerabilities

WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby() (named gp_add_master_standby() in WHPG 6, kept as an alias in WHPG 7). Unlike other segment add and remove functions, it does not require superuser privileges. A low-privileged user who can open a utility-mode connection can add a fake standby coordinator entry to gp_segment_configuration on a cluster with no standby configured, preventing administrators from adding a real standby until a superuser removes the fake entry. User data is not exposed or modified.

WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 have a missing authorization vulnerability (CWE-862) in the cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them without privilege checks, allowing catalog changes to be blocked cluster-wide or sessions with temporary tables to be repeatedly disconnected.

WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can run this function without a GRANT, bypassing the superuser restriction PostgreSQL places on the underlying pg_log_backend_memory_contexts() function. A low-privileged user can force segment backends of any other session, including superuser sessions, to write memory context details to segment server logs, which may include query text from other users' cached plans.

WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability (CWE-862) in the built-in server-side file functions pg_file_write, pg_file_rename, pg_file_unlink, and pg_logdir_ls. These functions are executable by any authenticated database role with no GRANT required, because the REVOKE applied in contrib/adminpack was never carried over to WHPG core. A non-superuser can create, overwrite, rename, and delete files under the data and log directories, and can enumerate log file names. They can also append configuration directives to postgresql.auto.conf, resulting in arbitrary code execution as the postgres OS user on the next server restart or configuration reload.