vulnerability

CentOS Linux: CVE-2023-2455: Moderate: postgresql security update (Multiple Advisories)

Severity
6
CVSS
(AV:N/AC:L/Au:S/C:P/I:P/A:N)
Published
2023-06-09
Added
2023-06-22
Modified
2025-01-28

Description

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.

Solution(s)

centos-upgrade-pg_repackcentos-upgrade-pg_repack-debuginfocentos-upgrade-pg_repack-debugsourcecentos-upgrade-pgauditcentos-upgrade-pgaudit-debuginfocentos-upgrade-pgaudit-debugsourcecentos-upgrade-postgres-decoderbufscentos-upgrade-postgres-decoderbufs-debuginfocentos-upgrade-postgres-decoderbufs-debugsourcecentos-upgrade-postgresqlcentos-upgrade-postgresql-contribcentos-upgrade-postgresql-contrib-debuginfocentos-upgrade-postgresql-debuginfocentos-upgrade-postgresql-debugsourcecentos-upgrade-postgresql-docscentos-upgrade-postgresql-docs-debuginfocentos-upgrade-postgresql-plperlcentos-upgrade-postgresql-plperl-debuginfocentos-upgrade-postgresql-plpython3centos-upgrade-postgresql-plpython3-debuginfocentos-upgrade-postgresql-pltclcentos-upgrade-postgresql-pltcl-debuginfocentos-upgrade-postgresql-private-develcentos-upgrade-postgresql-private-libscentos-upgrade-postgresql-private-libs-debuginfocentos-upgrade-postgresql-servercentos-upgrade-postgresql-server-debuginfocentos-upgrade-postgresql-server-develcentos-upgrade-postgresql-server-devel-debuginfocentos-upgrade-postgresql-staticcentos-upgrade-postgresql-testcentos-upgrade-postgresql-test-debuginfocentos-upgrade-postgresql-test-rpm-macroscentos-upgrade-postgresql-upgradecentos-upgrade-postgresql-upgrade-debuginfocentos-upgrade-postgresql-upgrade-develcentos-upgrade-postgresql-upgrade-devel-debuginfo
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.