Opengauss
Monthly
Unsafe reflective class loading in openGauss-connector-jdbc's LogFactory lets an attacker who controls the JDBC 'logger' connection parameter (URL or connection properties) force the driver to instantiate an arbitrary class present on the client classpath via its String-argument constructor before any Log subtype check occurs, enabling unintended class-loading and constructor side effects. Affected builds run from JDBC 1.1.0 through the 2.x/3.x/5.x/6.x lines (including 6.0.6) and 7.0.0-RC1/RC2/RC3; the flaw is fixed in 7.0.0-LTS. Exploitation is precondition-heavy - local/config-level influence over connection settings (CVSS 7.0, AV:L/AC:H/PR:L) plus a suitable gadget class on the classpath - and no public exploit has been identified at time of analysis.
Missing authorization in openGauss Server 3.0.0 through 6.0.0 lets any authenticated low-privilege database user read raw table-data blocks without holding SELECT on the target table. The user can call pg_relation_filepath() to obtain the relation file path, including compressed _compress paths, then call pg_read_binary_file_blocks() to read blocks because the underlying ReadBinaryFileBlocksFirstCall() and is_row_data_file() checks cover path normalization and data-directory boundaries but not caller privileges. The issue is fixed in 7.0.0-LTS, has a CVSS score of 4.3 (PR:L, C:L), and no public exploit was identified at time of analysis.
An issue in Huawei Technologies opengauss (openGauss 5.0.0 build) v.7.3.0 allows a local attacker to cause a denial of service via the modification of table attributes. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Unsafe reflective class loading in openGauss-connector-jdbc's LogFactory lets an attacker who controls the JDBC 'logger' connection parameter (URL or connection properties) force the driver to instantiate an arbitrary class present on the client classpath via its String-argument constructor before any Log subtype check occurs, enabling unintended class-loading and constructor side effects. Affected builds run from JDBC 1.1.0 through the 2.x/3.x/5.x/6.x lines (including 6.0.6) and 7.0.0-RC1/RC2/RC3; the flaw is fixed in 7.0.0-LTS. Exploitation is precondition-heavy - local/config-level influence over connection settings (CVSS 7.0, AV:L/AC:H/PR:L) plus a suitable gadget class on the classpath - and no public exploit has been identified at time of analysis.
Missing authorization in openGauss Server 3.0.0 through 6.0.0 lets any authenticated low-privilege database user read raw table-data blocks without holding SELECT on the target table. The user can call pg_relation_filepath() to obtain the relation file path, including compressed _compress paths, then call pg_read_binary_file_blocks() to read blocks because the underlying ReadBinaryFileBlocksFirstCall() and is_row_data_file() checks cover path normalization and data-directory boundaries but not caller privileges. The issue is fixed in 7.0.0-LTS, has a CVSS score of 4.3 (PR:L, C:L), and no public exploit was identified at time of analysis.
An issue in Huawei Technologies opengauss (openGauss 5.0.0 build) v.7.3.0 allows a local attacker to cause a denial of service via the modification of table attributes. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.