NA

CVE-2023-2455

Published: 09/06/2023 Updated: 06/07/2023
CVSS v3 Base Score: 5.4 | Impact Score: 2.5 | Exploitability Score: 2.8
VMScore: 0

Vulnerability Summary

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

postgresql postgresql

redhat enterprise linux 8.0

redhat software collections -

redhat enterprise linux 9.0

fedoraproject fedora 38

Vendor Advisories

Two security issues were found in PostgreSQL, which may result in privilege escalation or incorrect policy enforcement For the stable distribution (bullseye), these problems have been fixed in version 1311-0+deb11u1 We recommend that you upgrade your postgresql-13 packages For the detailed security status of postgresql-13 please refer to its se ...
Synopsis Important: rh-postgresql13-postgresql security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for rh-postgresql13-postgresql is now available for Red Hat Software CollectionsRed Hat Product Sec ...
Synopsis Important: postgresql:12 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 84 Advanced Mission Critical Update S ...
Synopsis Important: postgresql security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for postgresql is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Security ha ...
Synopsis Moderate: rh-postgresql12-postgresql security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for rh-postgresql12-postgresql is now available for Red Hat Software CollectionsRed Hat Product Secur ...
Synopsis Important: postgresql:12 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Pr ...
概述 Important: postgresql:12 security update 类型/严重性 Security Advisory: Important Red Hat Insights 补丁分析 识别并修复受此公告影响的系统。 查看受影响的系统 标题 An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 82 Advanced Update Support, Red Hat Enterprise ...
Synopsis Moderate: postgresql:13 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the postgresql:13 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated thi ...
Synopsis Moderate: postgresql:12 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated thi ...
Synopsis Important: postgresql:13 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the postgresql:13 module is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Pr ...
Synopsis Moderate: postgresql security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for postgresql is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as havin ...
Synopsis Moderate: postgresql:10 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the postgresql:10 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated thi ...
Synopsis Important: postgresql:13 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the postgresql:13 module is now available for Red Hat Enterprise Linux 84 Advanced Mission Critical Update S ...
Description<!----> This CVE is under investigation by Red Hat Product Security ...
This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser Database owners have that right by default, and explicit grants may extend it to other users (CVE-2023-2454) While CVE-2016-2193 fixed most interaction between row security and user ID changes, it missed a scenario involving functi ...
postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862) This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser Database owners have that right by default, and explicit grants may extend it to other users (CVE-2023-2454) While CVE-2016-2193 ...
postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862) This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser Database owners have that right by default, and explicit grants may extend it to other users (CVE-2023-2454) While CVE-2016-2193 ...
postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862) This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser Database owners have that right by default, and explicit grants may extend it to other users (CVE-2023-2454) While CVE-2016-2193 ...
Hitachi Infrastructure Analytics Advisor contains the following vulnerabilities: CVE-2019-10172, CVE-2019-10202, CVE-2021-37533 Hitachi Ops Center Analyzer contains the following vulnerabilities: CVE-2019-10172, CVE-2019-10202, CVE-2021-37533, CVE-2022-1471, CVE-2023-1370, CVE-2023-26048, CVE-2023-26049 Hitachi Ops Center Analyzer viewpoi ...
While CVE-2016-2193 fixed most interaction between row security and user ID changes, it missed a scenario involving function inlining This leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles This scenario can happen u ...