V-233543
Crunchy Data PostgreSQL Security Technical Implementation Guide
Title
Execution of software modules (to include functions and trigger procedures) with elevated privileges must be restricted to necessary cases only.
Description
<VulnDiscussion>In certain situations, to provide required functionality, PostgreSQL needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided with greater privileges than assigned by organizations. Privilege ele...
Fix Text (Documentation Requirement)
Determine where, when, how, and by what principals/subjects elevated privilege is needed. To change a SECURITY DEFINER function to SECURITY INVOKER, as the database administrator (shown here as "postgres"), run the following SQL: $ sudo su - postgres $ psql -c "ALTER FUNCTION <function_name> SECURITY INVOKER"