NA

CVE-2023-2454

Published: 09/06/2023 Updated: 06/07/2023
CVSS v3 Base Score: 7.2 | Impact Score: 5.9 | Exploitability Score: 1.2
VMScore: 0

Vulnerability Summary

schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

postgresql postgresql

redhat enterprise linux 8.0

redhat software collections -

redhat enterprise linux 9.0

fedoraproject fedora 38

Vendor Advisories

Two security issues were found in PostgreSQL, which may result in privilege escalation or incorrect policy enforcement For the stable distribution (bullseye), these problems have been fixed in version 1311-0+deb11u1 We recommend that you upgrade your postgresql-13 packages For the detailed security status of postgresql-13 please refer to its se ...
This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser Database owners have that right by default, and explicit grants may extend it to other users (CVE-2023-2454) ...
Synopsis Important: rh-postgresql13-postgresql security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for rh-postgresql13-postgresql is now available for Red Hat Software CollectionsRed Hat Product Sec ...
Synopsis Important: postgresql:12 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 84 Advanced Mission Critical Update S ...
Synopsis Important: postgresql security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for postgresql is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Security ha ...
Synopsis Moderate: rh-postgresql12-postgresql security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for rh-postgresql12-postgresql is now available for Red Hat Software CollectionsRed Hat Product Secur ...
Synopsis Important: postgresql:12 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Pr ...
概述 Important: postgresql:12 security update 类型/严重性 Security Advisory: Important Red Hat Insights 补丁分析 识别并修复受此公告影响的系统。 查看受影响的系统 标题 An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 82 Advanced Update Support, Red Hat Enterprise ...
Synopsis Moderate: postgresql:13 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the postgresql:13 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated thi ...
Synopsis Moderate: postgresql:12 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated thi ...
Synopsis Important: postgresql:13 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the postgresql:13 module is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Pr ...
Synopsis Moderate: postgresql security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for postgresql is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as havin ...
Synopsis Moderate: postgresql:10 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the postgresql:10 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated thi ...
Synopsis Important: postgresql:13 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the postgresql:13 module is now available for Red Hat Enterprise Linux 84 Advanced Mission Critical Update S ...
This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser Database owners have that right by default, and explicit grants may extend it to other users (CVE-2023-2454) While CVE-2016-2193 fixed most interaction between row security and user ID changes, it missed a scenario involving functi ...
postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862) This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser Database owners have that right by default, and explicit grants may extend it to other users (CVE-2023-2454) While CVE-2016-2193 ...
postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862) This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser Database owners have that right by default, and explicit grants may extend it to other users (CVE-2023-2454) While CVE-2016-2193 ...
postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862) This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser Database owners have that right by default, and explicit grants may extend it to other users (CVE-2023-2454) While CVE-2016-2193 ...
This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser Database owners have that right by default, and explicit grants may extend it to other users (CVE-2023-2454) ...
Multiple vulnerabilities have been found in Hitachi Ops Center Common Services CVE-2022-3143, CVE-2022-41881, CVE-2022-42003, CVE-2022-42004, CVE-2022-45787, CVE-2023-0264, CVE-2023-0482, CVE-2023-2454 Affected products and versions are listed below Please upgrade your version to the appropriate version ...
Hitachi Infrastructure Analytics Advisor contains the following vulnerabilities: CVE-2019-10172, CVE-2019-10202, CVE-2021-37533 Hitachi Ops Center Analyzer contains the following vulnerabilities: CVE-2019-10172, CVE-2019-10202, CVE-2021-37533, CVE-2022-1471, CVE-2023-1370, CVE-2023-26048, CVE-2023-26049 Hitachi Ops Center Analyzer viewpoi ...
This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser Database owners have that right by default, and explicit grants may extend it to other users ...