Threats tagged 'ghsa-mxqp-rrfg-8vgh'

A vulnerability in pgAdmin 4 before version 9.19 allows any user in server mode to specify a connection service from the operating system account's service file, potentially using stored credentials such as passwords or client certificates. This occurs because libpq looks up connection services in the service file of the OS account running pgAdmin 4 and uses environment variables like PGPASSWORD or PGSERVICE without restriction. The issue is addressed by introducing the SERVER_MODE_ALLOWED_SERVICES setting, which restricts allowed services and removes sensitive environment variables at startup.