Ubuntu.comUB:CVE-2023-2455CVE-2023-2455
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
40.5%
Row security policies disregard user ID changes after inlining; PostgreSQL
could permit incorrect policies to be applied in certain cases where
role-specific policies are used and a given query is planned under one role
and then executed under other roles. This scenario can happen under
security definer functions or when a common user and query is planned
initially and then re-used across multiple SET ROLEs. Applying an incorrect
policy may permit a user to complete otherwise-forbidden reads and
modifications. This affects only databases that have used CREATE POLICY to
define a row security policy.
Notes
| Author | Note |
|---|---|
| leosilva | PostgreSQL 9.3 is end of life upstream, and no updates are are available. Marking as deferred in -esm-main releases. PostgreSQL 9.3 is end of life upstream, and no updates are are available. Marking as deferred in -esm-main releases. |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | postgresql-10 | < 10.23-0ubuntu0.18.04.2 | UNKNOWN |
| ubuntu | 20.04 | noarch | postgresql-12 | < 12.15-0ubuntu0.20.04.1 | UNKNOWN |
| ubuntu | 22.04 | noarch | postgresql-14 | < 14.8-0ubuntu0.22.04.1 | UNKNOWN |
| ubuntu | 22.10 | noarch | postgresql-14 | < 14.8-0ubuntu0.22.10.1 | UNKNOWN |
| ubuntu | 23.04 | noarch | postgresql-15 | < 15.3-0ubuntu0.23.04.1 | UNKNOWN |
| ubuntu | 14.04 | noarch | postgresql-9.3 | < any | UNKNOWN |
Related
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
40.5%