From: | Usman Khan <umk555(at)gmail(dot)com> |
---|---|
To: | Dave Page <dpage(at)pgadmin(dot)org>, pgadmin-hackers(at)lists(dot)postgresql(dot)org |
Subject: | Re: Potential Security Issue: Permissions in PgAdmin Installation Directory |
Date: | 2024-06-02 09:27:55 |
Message-ID: | CANVC+RF0m_YhGwfdCQP1nPoriDWaX_+Juphe=koHQiKRt2QvzQ@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgadmin-hackers |
On Sat, Jun 1, 2024 at 3:09 AM Dave Page <dpage(at)pgadmin(dot)org> wrote:
> Hi
>
> On Thu, 30 May 2024 at 23:17, Qasim Tahir <qasimtahir(dot)qt1(at)gmail(dot)com>
> wrote:
>
>> Dear PgAdmin Community,
>>
>> I am writing to report a potential security issue with the permissions
>> set in the PgAdmin installation directory.
>>
>> After installing PgAdmin, I observed that several directories, including
>> 'bin', 'venv', and 'web', have 775 permissions. Here are the details of the
>> directory permissions:
>> [image: image.png]
>>
>> Given the broad access provided by 775 permissions, there is a concern
>> about the potential for unauthorized access or modifications.
>>
>>
>> I would like to ask if these permissions are necessary for PgAdmin's
>> operation or if they could be tightened to enhance security.
>>
>> Your guidance on this matter would be greatly appreciated.
>>
>> Thank you for your attention to this issue.
>>
>
> What platform and package is this exactly?
>
FYI - this behaviour is reproducible on ubuntu 22.04 and rockey 8.9 with
the latest installers for me.
*ubuntu 22.04*
[image: image.png]
*rockey 8.9 - installed through guidance on this link *
https://www.pgadmin.org/download/pgadmin-4-rpm/
[image: image.png]
> --
> Dave Page
> pgAdmin: https://www.pgadmin.org
> PostgreSQL: https://www.postgresql.org
> EDB: https://www.enterprisedb.com
>
>
From | Date | Subject | |
---|---|---|---|
Next Message | Usman Khan | 2024-06-02 09:29:45 | Re: Messages held for moderation |
Previous Message | Dave Page | 2024-06-01 15:04:18 | Re: Potential Security Issue: Permissions in PgAdmin Installation Directory |