Vulnerability-Lookup

Vulnerability from bitnami_vulndb

Published

2025-05-13 07:30

Modified

2025-05-13 07:30

Summary

Details

The PgPool II component into a Bitnami Pgpool II container image comes by default configured with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. This can be addressed by mounting and overwriting the Pgpool configuration file directly. If PgPool is exposed externally, a potential attacker could use this user to get access to the service.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "pgpool",
        "purl": "pkg:bitnami/pgpool"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.0-1"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/CR:H/IR:H/AR:H/MAV:A/MAC:L/MAT:N/MPR:N/MUI:N/MVC:H/MVI:H/MVA:H/MSC:H/MSI:H/MSA:H",
          "type": "CVSS_V4"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-22248"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:*:pgpool:pgpooladmin:*:*:*:*:*:*:*:*"
    ],
    "severity": "Critical"
  },
  "details": "The PgPool II component into a Bitnami Pgpool II container image comes by default configured with an \u0027repmgr\u0027 user that allows unauthenticated access to the database inside the cluster. This can be addressed by mounting and overwriting the Pgpool configuration file directly. If PgPool is exposed externally, a potential attacker could use this user to get access to the service.",
  "id": "BIT-pgpool-2025-22248",
  "modified": "2025-05-13T07:30:00.000Z",
  "published": "2025-05-13T07:30:00.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bitnami/charts/security/advisories/GHSA-mx38-x658-5fwj"
    }
  ],
  "schema_version": "1.6.2"
}

CVE-2025-22248 (GCVE-0-2025-22248)

Vulnerability from cvelistv5 – Published: 2025-05-13 09:13 – Updated: 2025-05-13 13:10

Title

[pgpool] Unauthenticated access to postgres through pgpool

Summary

The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database using the repgmr user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha Kubernetes Helm chart.

Severity ?

9.4 (Critical)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CWE

CWE-1188 - Initialization of a Resource with an Insecure Default

Assigner

vmware

References

URL

Tags

https://github.com/bitnami/charts/security/adviso…

Impacted products

Vendor

Product

Version

VMware

Bitnami

Affected: * , < 4.6.0-debian-12-r8 (git)

VMware

Bitnami

Affected: * , < 16.0.0 (git)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22248",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-13T13:10:00.979591Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1188",
                "description": "CWE-1188 Initialization of a Resource with an Insecure Default",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-13T13:10:31.070Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageName": "bitnami/pgpool",
          "product": "Bitnami",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "4.6.0-debian-12-r8",
              "status": "affected",
              "version": "*",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "packageName": "bitnami/postgres-ha",
          "product": "Bitnami",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "16.0.0",
              "status": "affected",
              "version": "*",
              "versionType": "git"
            }
          ]
        }
      ],
      "datePublic": "2025-05-13T08:09:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe \u003c/span\u003e\u003ccode\u003ebitnami/pgpool\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;Docker image, and the \u003c/span\u003e\u003ccode\u003ebitnami/postgres-ha\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;k8s chart, under default configurations, comes with an \u0027repmgr\u0027 user that allows unauthenticated access to the database inside the cluster.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe \u003c/span\u003e\u003ccode\u003ePGPOOL_SR_CHECK_USER\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at \u003c/span\u003e\u003ccode\u003etrust\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;level. This allows to log into a PostgreSQL database using the \u003c/span\u003e\u003ccode\u003erepgmr\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the \u003c/span\u003e\u003ccode\u003ebitnami/postgres-ha\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;Kubernetes Helm chart.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "The bitnami/pgpool\u00a0Docker image, and the bitnami/postgres-ha\u00a0k8s chart, under default configurations, comes with an \u0027repmgr\u0027 user that allows unauthenticated access to the database inside the cluster.\u00a0The PGPOOL_SR_CHECK_USER\u00a0is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust\u00a0level. This allows to log into a PostgreSQL database using the repgmr\u00a0user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha\u00a0Kubernetes Helm chart."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-13T09:13:30.613Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://github.com/bitnami/charts/security/advisories/GHSA-mx38-x658-5fwj"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "[pgpool] Unauthenticated access to postgres through pgpool",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2025-22248",
    "datePublished": "2025-05-13T09:13:30.613Z",
    "dateReserved": "2025-01-02T04:30:19.929Z",
    "dateUpdated": "2025-05-13T13:10:31.070Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

Vulnerability from bitnami_vulndb

CVE-2025-22248 (GCVE-0-2025-22248)

Tags

Sightings

Nomenclature