path: root/templates/security/security.html

{%extends "base/page.html"%}
{%block title%}Security Information{%endblock%}
{%block contents%}

<h1>Security Information <i class="fas fa-lock"></i></h1>

<p>
  The PostgreSQL Global Development Group (PGDG) takes security seriously. This
  allows our users to place their trust in PostgreSQL for protecting their
  mission-critical data.
</p>

<p>
  The PostgreSQL Global Development Group follows a model that shares
  responsibility between PostgreSQL itself and its deployment environment,
  including hardware, operating system, and the application layer
  (programming language, frameworks and client libraries). The PostgreSQL
  documentation provides info on the inherent security features of PostgreSQL
  and how to securely configure and run PostgreSQL.
</p>

<p>
  Security vulnerabilities can exist both in PostgreSQL and software within the
  PostgreSQL ecosystem, including client libraries, extensions, installers,
  and other utilities. This page walks through what is considered a security
  vulnerability in PostgreSQL, how to report PostgreSQL security
  vulnerabilities, and how fixes for security vulnerabilities are released.
</p>

<p>
  Please note that the PostgreSQL Project does not offer bug bounties.
</p>

<h2>CVE Numbering Authority</h2>

<p>
  The PostgreSQL Project is a CVE Numbering Authority (CNA), working with Red Hat
  as our CNA Root. This allows us to assign our own CVE numbers and publish CVE
  records for PostgreSQL and closely related projects.
</p>

<p>
  We will currently assign CVE numbers for the following projects upon request to
  <a href="mailto:cna@postgresql.org">cna@postgresql.org</a>:
</p>

<ul>
  <li><a href="https://www.postgresql.org/">PostgreSQL</a></li>
  <li><a href="https://yum.postgresql.org/">PostgreSQL RPM packaging</a></li>
  <li><a href="https://apt.postgresql.org/">PostgreSQL DEB packaging</a></li>
  <li><a href="https://github.com/EnterpriseDB/edb-installers">PostgreSQL Windows/macOS installers (EDB)</a></li>
  <li><a href="https://jdbc.postgresql.org/">pgJDBC</a></li>
  <li><a href="https://odbc.postgresql.org/">psqlODBC</a></li>
  <li><a href="https://www.pgadmin.org/">pgAdmin</a></li>
  <li><a href="https://www.pgbouncer.org/">PgBouncer</a></li>
</ul>

<p>
  Additional projects may request inclusion on the list above by emailing
  <a href="mailto:cna@postgresql.org">cna@postgresql.org</a>.
</p>

<p>
  <strong>NOTE:</strong> The security team will only assign CVEs to projects
  when requested by members of the project. If you think you've found a security
  issue in a project other than PostgreSQL or it's packages and installers,
  please contact the security team for that project. See below for more details.
</p>

<h2>What is a Security Vulnerability in PostgreSQL?</h2>

<p>
  A security vulnerability in PostgreSQL is an issue that allows a user to gain
  access to privileges or data that they do not have permission to use, or
  allows a user to execute arbitrary code through a PostgreSQL process.
</p>

<p>
  The PostgreSQL Security Team does not consider reports on actions a PostgreSQL
  superuser takes to be a security vulnerability. However, a report on an
  unprivileged user escalating to superuser generally qualifies as valid.
</p>

<p>
  The PostgreSQL Security Team typically does not consider a denial-of-service
  on a PostgreSQL server from an authenticated, valid SQL statement to be a
  security vulnerability. A denial-of-service issue of this nature could still
  be a <a href="/account/submitbug/">bug</a>, and we encourage you to report it
  on the <a href="/account/submitbug/">Report a Bug</a> page.
</p>

<p>
  Please do not report the lack of DMARC on postgresql.org mailing lists. This
  is by design.
</p>

<h2>Reporting a PostgreSQL Security Vulnerability</h2>

<p>
  For security vulnerabilities in PostgreSQL or any of the installers linked
  from the <a href="/download/">PostgreSQL download page</a>, please email
  <a href="mailto:security@postgresql.org">security@postgresql.org</a>.
</p>

<p>
  For reporting non-security bugs, please visit the
  <a href="/account/submitbug/">Report a Bug</a> page.
</p>

<p>
  If you are unsure if an issue is a security vulnerability, please err on the
  side of caution and email
  <a href="mailto:security@postgresql.org">security@postgresql.org</a>.
</p>

<h2>Reporting non-PostgreSQL Security Vulnerabilities</h2>

<p>
  Please see below for how you can report security vulnerabilities in
  PostgreSQL-related projects:
</p>

<ul>
  <li>
    For security vulnerabilities in the <a href="https://jdbc.postgresql.org">PostgreSQL JDBC Driver</a>,
    please email
    <a href="mailto:pgsql-jdbc-security@lists.postgresql.org">pgsql-jdbc-security@lists.postgresql.org</a>.
  </li>
  <li>
    For security vulnerabilities in <a href="https://www.pgadmin.org/">pgAdmin</a>,
    please email <a href="mailto:security@pgadmin.org">security@pgadmin.org</a>.
  </li>
  <li>
    If you wish to report a security vulnerability for any other open source project in
    the PostgreSQL ecosystem (e.g. a driver, an extension, or an installer) and
    need a secure communication channel, please email
    <a href="mailto:security@postgresql.org">security@postgresql.org</a>.
  </li>
</ul>

<h2>PostgreSQL Security Releases</h2>

<p>
  The PostgreSQL Project releases security fixes as part of
  <a href="/support/versioning/">minor version updates</a>. You are always
  advised to use the latest minor version available, as it will contain other
  non-security related fixes.
</p>

<p>
  A new PostgreSQL major release, which contains new features, has every prior
  security fix.
</p>

<p>
  If you find a security vulnerability in PostgreSQL, the PostgreSQL Security
  Team will credit you in the release notes and register a CVE for the
  vulnerability. <strong>Please do not register a CVE independently of the
  PostgreSQL Security Team</strong>.
</p>

<h2>PostgreSQL Security Notifications</h2>

<p>
  To receive notifications about security releases or other security
  related news, you can subscribe to
  the <a href="/list/">pgsql-announce</a> mailing list. If you set your
  subscription to only include the tag <em>Security</em>, it will
  exclude all other announcements that are sent to this list.
</p>

<h2>Known PostgreSQL Security Vulnerabilities</h2>

<p>
  The PostgreSQL Global Development Group believes that accuracy, completeness
  and availability of security information is essential for our users. We choose
  to pool all information on this one page, allowing easy searching for security
  vulnerabilities over a range of criteria.  This includes:
</p>

<ul>
  <li>Which major versions a security vulnerability is present in</li>
  <li>Which minor version update releases a security vulnerability is fixed in</li>
  <li>Whether an exploit requires a valid login</li>
  <li>CVSS score</li>
</ul>

<p>
  You can find more detailed information about a security vulnerability by
  clicking on the links in the table below.
</p>

<h3>
  Known PostgreSQL Security Vulnerabilities in
  {%if version%}PostgreSQL {{version.numtree}}{%else%}Supported Versions{%endif%}
</h3>

{%if version and not version.supported%}
<div class="border border-danger text-danger text-center mb-3">
  <h1 class="text-danger">UNSUPPORTED VERSION</h1>
  <p>
    You are currently viewing PostgreSQL security vulnerabilities for an
    unsupported version. If you are still using PostgreSQL {{version.numtree}},
    you should upgrade as soon as possible.
  </p>
</div>
{% endif %}

<p>
  You can filter the view of patches to show just patches for version:<br />
  {%for v in supported%}
    <a href="/support/security/{{v.numtree}}/">{{v.numtree}}</a>{%if not forloop.last%} -{%endif%}
  {%endfor%}
  - <a href="/support/security/">all</a>
</p>

<table class="table table-striped">
  <thead>
    <tr>
      <th>Reference</th>
      <th>Affected</th>
      <th>Fixed</th>
      <th><a href="#comp">Component</a> & CVSS v3 Base Score</th>
      <th>Description</th>
    </tr>
  </thead>
  <tbody>
    {%for p in patches%}
      <tr>
        <td>
          {%if p.cve%}<span class="nobr"><a href="/support/security/CVE-{{ p.cve }}/">CVE-{{p.cve}}</a></span><br/>{%endif%}
          {%if p.newspost%}<a href="/about/news/{{p.newspost.title|slugify}}-{{p.newspost.id}}/">Announcement</a><br/>{%endif%}
        </td>
        <td>{{p.affected|join:", "}}</td>
        <td>{{p.fixed|join:", "}}</td>
        <td>{{p.component}}<br/>
          {%if p.cvssscore >= 0%}<a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector={{p.cvssvector}}">{{p.cvssscore}}</a><br/><span class="cvssvector">{{p.cvssvector}}</span>
    {%else%}Legacy: {{p.legacyscore}}{%endif%}</td>
        <td>{{p.description}}<br/><br/><a href="/support/security/CVE-{{ p.cve }}/">more details</a></td>
      </tr>
    {% endfor %}
  </tbody>
</table>

<h3>Unsupported versions</h3>

<p>
  You can also view archived security patches for unsupported versions. Note that no further
  security patches are made available for these versions as they are end of life.<br/>
  {%for v in unsupported%}
    <a href="/support/security/{{v.numtree}}/">{{v.numtree}}</a>{%if not forloop.last%} -{%endif%}
  {%endfor%}
</p>

<h3 id="comp">Components</h3>

<p>
  The following component references are used in the above table:
</p>

<table class="table table-striped">
  <thead>
    <tr>
      <th>Component</th>
      <th>Description</th>
    </tr>
  </thead>
  <tbody>
      <tr>
       <td>core server</td>
       <td>This vulnerability exists in the core server product.</td>
      </tr>

      <tr>
       <td>client</td>
       <td>This vulnerability exists in a client library or client application only.</td>
      </tr>

      <tr>
       <td>contrib module</td>
       <td>This vulnerability exists in a contrib module. Contrib modules are not installed by default when PostgreSQL is installed from source. They may be installed by binary packages.</td>
      </tr>

      <tr>
       <td>client contrib module</td>
       <td>This vulnerability exists in a contrib module used on the client only.</td>
      </tr>

      <tr>
       <td>packaging</td>
       <td>This vulnerability exists in PostgreSQL binary packaging, e.g. an installer or RPM.</td>
      </tr>
  </tbody>
</table>

<h2>The PostgreSQL Security Team</h2>

<p>
  The PostgreSQL Security Team is made up of a group of contributors to the
  PostgreSQL project who have experience in different aspects of database and
  information security.
</p>

<p>
  You can find a list of members on the security team here:
</p>

<ul>
  <li>Álvaro Herrera</li>
  <li>Andres Freund</li>
  <li>Andrew Dunstan</li>
  <li>Bruce Momjian</li>
  <li>Dave Page</li>
  <li>Greg Stark</li>
  <li>Heikki Linnakangas</li>
  <li>Joe Conway</li>
  <li>Jonathan Katz</li>
  <li>Magnus Hagander</li>
  <li>Michael Paquier</li>
  <li>Nathan Bossart</li>
  <li>Noah Misch</li>
  <li>Peter Eisentraut</li>
  <li>Robert Haas</li>
  <li>Stefan Kaltenbrunner</li>
  <li>Tom Lane</li>
</ul>
{%endblock%}