topic Patch NPrinting in Qlik NPrinting

Patch NPrinting

jvandrot — Thu, 29 Feb 2024 16:15:27 GMT

Is there a patch planned for NPrinting to address the PostgreSQL security problem?

Re: Patch NPrinting

JonnyPoole — Thu, 29 Feb 2024 17:48:09 GMT

Which problem are you referring to? There was a postgresql upgrade included in NPrinting February 2024.

Re: Patch NPrinting

jvandrot — Mon, 04 Mar 2024 08:37:16 GMT

Hello,

I'm reffering to the security breach dated from Februray 8th, which is fixed on update 13.14

The february version is 13.13

https://www.postgresql.org/support/security/

Reference	Affected	Fixed	Component & CVSS v3 Base Score	Description
CVE-2024-0985 Announcement	15, 14, 13, 12	15.6, 14.11, 13.14, 12.18	core server 8.0 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL more details

Re: Patch NPrinting

Andrew_Kruger — Mon, 04 Mar 2024 16:35:23 GMT

Thanks for the post @jvandrot

The Qlik NPrinting product team and our security team are in constant communication around various identified security topics. This item is on our radar and is being planned for resolution in an Service Release for both the Qlik NPrinting May 2023 and Qlik NPrinting February 2024 build lines.

In the mean time it is worth noting that this vulnerability is not exploitable in Qlik NPrinting as the product does not allow users to construct such kind of query required to exploit the vulnerability. Even though the product accepts user input (which is sanitized as part of a defense-in-depth strategy), there is no way in the product to create the kind of query required for exploitation in this scenario.
A theoretical attack would require an advisory to get direct access to the NPrinting database as well as privileged filesystem access in addition to several other preconditions be met. If such escalated privileged access would be possible, there would other ways to yield more gain or access.

Re: Patch NPrinting

David_Friend — Mon, 04 Mar 2024 21:28:25 GMT

@jvandrot R&D will be doing a Service Release of NP with the 13.14 version, but like Andrew said its not a security concern for NP