Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2023-5870
HistoryDec 10, 2023 - 6:15 p.m.

CVE-2023-5870

2023-12-1018:15:07
CWE-400
[email protected]
web.nvd.nist.gov
postgresql
vulnerability
pg_cancel_backend
background workers
denial of service
remote user

4.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

46.9%

JSON

A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.

Affected configurations

NVD
Node
postgresqlpostgresqlRange11.0–11.22
OR
postgresqlpostgresqlRange12.0–12.17
OR
postgresqlpostgresqlRange13.0–13.13
OR
postgresqlpostgresqlRange14.0–14.10
OR
postgresqlpostgresqlRange15.0–15.5
OR
postgresqlpostgresqlMatch16.0
Node
redhatcodeready_linux_builder_eusMatch9.2
OR
redhatcodeready_linux_builder_eus_for_power_little_endian_eusMatch9.0_ppc64le
OR
redhatcodeready_linux_builder_eus_for_power_little_endian_eusMatch9.2_ppc64le
OR
redhatcodeready_linux_builder_for_arm64_eusMatch8.6_aarch64
OR
redhatcodeready_linux_builder_for_arm64_eusMatch9.0_aarch64
OR
redhatcodeready_linux_builder_for_arm64_eusMatch9.2_aarch64
OR
redhatcodeready_linux_builder_for_ibm_z_systems_eusMatch9.0_s390x
OR
redhatcodeready_linux_builder_for_ibm_z_systems_eusMatch9.2_s390x
OR
redhatcodeready_linux_builder_for_power_little_endian_eusMatch9.0_ppc64le
OR
redhatcodeready_linux_builder_for_power_little_endian_eusMatch9.2_ppc64le
OR
redhatsoftware_collectionsMatch1.0
OR
redhatenterprise_linuxMatch8.0
OR
redhatenterprise_linuxMatch9.0
OR
redhatenterprise_linux_eusMatch8.6
OR
redhatenterprise_linux_eusMatch8.8
OR
redhatenterprise_linux_eusMatch9.0
OR
redhatenterprise_linux_eusMatch9.2
OR
redhatenterprise_linux_for_arm_64Match8.0
OR
redhatenterprise_linux_for_arm_64Match8.8_aarch64
OR
redhatenterprise_linux_for_ibm_z_systemsMatch8.0_s390x
OR
redhatenterprise_linux_for_ibm_z_systems_eusMatch8.6_s390x
OR
redhatenterprise_linux_for_ibm_z_systems_eusMatch8.8_s390x
OR
redhatenterprise_linux_for_ibm_z_systems_eusMatch9.0_s390x
OR
redhatenterprise_linux_for_ibm_z_systems_eusMatch9.2_s390x
OR
redhatenterprise_linux_for_power_little_endianMatch8.0_ppc64le
OR
redhatenterprise_linux_for_power_little_endian_eusMatch8.6_ppc64le
OR
redhatenterprise_linux_for_power_little_endian_eusMatch8.8_ppc64le
OR
redhatenterprise_linux_for_power_little_endian_eusMatch9.0_ppc64le
OR
redhatenterprise_linux_for_power_little_endian_eusMatch9.2_ppc64le
OR
redhatenterprise_linux_server_ausMatch8.2
OR
redhatenterprise_linux_server_ausMatch8.4
OR
redhatenterprise_linux_server_ausMatch8.6
OR
redhatenterprise_linux_server_ausMatch9.2
OR
redhatenterprise_linux_server_tusMatch8.2
OR
redhatenterprise_linux_server_tusMatch8.4
OR
redhatenterprise_linux_server_tusMatch8.6

References

Related

veracode 1
ubuntucve 1
cvelist 1
cgr 1
cbl_mariner 1
redhatcve 1
nessus 58
osv 16
cve 1
freebsd 1
alpinelinux 1
debiancve 1
prion 1
ibm 7
wolfi 1
openvas 23
ubuntu 3
kaspersky 1
debian 3
mageia 1
redos 4
cloudfoundry 1
redhat 21
oraclelinux 5
rocky 3
almalinux 5
photon 1
hp 1
veracode
veracode
Denial Of Service (DOS)
2023-11-27 21:04:45
ubuntucve
ubuntucve
CVE-2023-5870
2023-11-15 00:00:00
cvelist
cvelist
CVE-2023-5870 Postgresql: role pg_signal_backend can signal certain superuser processes.
2023-12-10 17:58:30
cgr
cgr
CVE-2023-5870 vulnerabilities
2024-05-19 03:07:16
cbl_mariner
cbl_mariner
CVE-2023-5870 affecting package postgresql for versions less than 16.3-1
2024-05-31 18:55:08
redhatcve
redhatcve
CVE-2023-5870
2023-11-10 10:44:58
nessus
nessus
FreeBSD : postgresql-server -- Role pg_cancel_backend can signal certain superuser processes (bbb18fcb-7f0d-11ee-94b4-6cc21735f730)
2023-11-09 00:00:00
Ubuntu 16.04 ESM : PostgreSQL vulnerabilities (USN-6570-1)
2024-01-09 00:00:00
PostgreSQL 11.x < 11.22 / 12.x < 12.17 / 13.x < 13.13 / 14.x < 14.10 / 15.x < 15.5 / 16.x < 16.1 Multiple Vulnerabilities
2023-11-15 00:00:00
osv
osv
BIT-postgresql-2023-5870
2024-03-06 11:02:29
CVE-2023-5870
2023-12-10 18:15:07
postgresql-9.5 vulnerabilities
2024-01-09 10:29:04
cve
cve
CVE-2023-5870
2023-12-10 18:15:07
freebsd
freebsd
postgresql-server -- Role pg_cancel_backend can signal certain superuser processes
2023-11-09 00:00:00
alpinelinux
alpinelinux
CVE-2023-5870
2023-12-10 18:15:07
debiancve
debiancve
CVE-2023-5870
2023-12-10 18:15:07
prion
prion
Design/Logic Flaw
2023-12-10 18:15:00
ibm
ibm
Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to a denial of service due to PostgreSQL (CVE-2023-5870)
2024-05-06 04:15:34
Security Bulletin: Multiple PostgreSQL Vulnerabilities Affect IBM Storage Scale System
2024-06-21 15:45:31
Security Bulletin: Vulnerabilities in PostgreSQL, Golang might affect IBM Spectrum Copy Data Management
2024-01-12 16:31:24
wolfi
wolfi
CVE-2023-5870 vulnerabilities
2024-06-24 09:08:26
openvas
openvas
Ubuntu: Security Advisory (USN-6570-1)
2024-01-10 00:00:00
openSUSE: Security Advisory for postgresql13 (SUSE-SU-2023:4455-1)
2024-03-04 00:00:00
openSUSE: Security Advisory for postgresql, postgresql15, postgresql16 (SUSE-SU-2023:4495-1)
2024-03-04 00:00:00
ubuntu
ubuntu
PostgreSQL vulnerabilities
2024-01-09 00:00:00
PostgreSQL vulnerabilities
2023-12-06 00:00:00
PostgreSQL vulnerabilities
2024-01-17 00:00:00
kaspersky
kaspersky
KLA61933 Multiple vulnerabilities in PostgreSQL
2023-11-09 00:00:00
debian
debian
[SECURITY] [DLA 3651-1] postgresql-11 security update
2023-11-14 08:34:40
[SECURITY] [DSA 5554-1] postgresql-13 security update
2023-11-13 21:27:39
[SECURITY] [DSA 5553-1] postgresql-15 security update
2023-11-13 21:15:25
mageia
mageia
Updated postgresql packages fix security vulnerabilities
2023-11-22 04:49:25
redos
redos
ROS-20240329-13
2024-03-29 00:00:00
ROS-20240329-14
2024-03-29 00:00:00
ROS-20240329-12
2024-03-29 00:00:00
cloudfoundry
cloudfoundry
USN-6538-1: PostgreSQL vulnerabilities | Cloud Foundry
2024-03-18 00:00:00
redhat
redhat
(RHSA-2023:7714) Important: postgresql:12 security update
2023-12-11 09:25:48
(RHSA-2023:7784) Important: postgresql security update
2023-12-13 14:48:22
(RHSA-2023:7770) Important: rh-postgresql12-postgresql security update
2023-12-13 07:47:10
oraclelinux
oraclelinux
postgresql:12 security update
2023-12-18 00:00:00
postgresql:13 security update
2023-11-30 00:00:00
postgresql security update
2023-12-15 00:00:00
rocky
rocky
postgresql:12 security update
2024-01-09 04:07:10
postgresql:13 security update
2023-12-06 23:16:33
postgresql:15 security update
2024-01-09 04:08:12
almalinux
almalinux
Important: postgresql:12 security update
2023-12-11 00:00:00
Important: postgresql:13 security update
2023-11-29 00:00:00
Important: postgresql security update
2023-12-13 00:00:00
photon
photon
Important Photon OS Security Update - PHSA-2023-4.0-0513
2023-11-16 00:00:00
hp
hp
HP Device Manager Vulnerability Update (5.0.12)
2024-01-26 00:00:00

4.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

46.9%

JSON
Related for NVD:CVE-2023-5870
veracode1ubuntucve1cvelist1cgr1cbl_mariner1redhatcve1nessus58osv16cve1freebsd1alpinelinux1debiancve1prion1ibm7wolfi1openvas23ubuntu3kaspersky1debian3mageia1redos4cloudfoundry1redhat21oraclelinux5rocky3almalinux5photon1hp1