vulnerability

Rocky Linux: CVE-2023-2455: postgresql-15 (Multiple Advisories)

Severity
6
CVSS
(AV:N/AC:L/Au:S/C:P/I:P/A:N)
Published
Jun 9, 2023
Added
Mar 5, 2024
Modified
Jan 19, 2026

Description

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.

Solutions

rocky-upgrade-pg_repackrocky-upgrade-pg_repack-debuginforocky-upgrade-pg_repack-debugsourcerocky-upgrade-pgauditrocky-upgrade-pgaudit-debuginforocky-upgrade-pgaudit-debugsourcerocky-upgrade-postgres-decoderbufsrocky-upgrade-postgres-decoderbufs-debuginforocky-upgrade-postgres-decoderbufs-debugsourcerocky-upgrade-postgresqlrocky-upgrade-postgresql-contribrocky-upgrade-postgresql-contrib-debuginforocky-upgrade-postgresql-debuginforocky-upgrade-postgresql-debugsourcerocky-upgrade-postgresql-docsrocky-upgrade-postgresql-docs-debuginforocky-upgrade-postgresql-plperlrocky-upgrade-postgresql-plperl-debuginforocky-upgrade-postgresql-plpython3rocky-upgrade-postgresql-plpython3-debuginforocky-upgrade-postgresql-pltclrocky-upgrade-postgresql-pltcl-debuginforocky-upgrade-postgresql-private-develrocky-upgrade-postgresql-private-libsrocky-upgrade-postgresql-private-libs-debuginforocky-upgrade-postgresql-serverrocky-upgrade-postgresql-server-debuginforocky-upgrade-postgresql-server-develrocky-upgrade-postgresql-server-devel-debuginforocky-upgrade-postgresql-staticrocky-upgrade-postgresql-testrocky-upgrade-postgresql-test-debuginforocky-upgrade-postgresql-test-rpm-macrosrocky-upgrade-postgresql-upgraderocky-upgrade-postgresql-upgrade-debuginforocky-upgrade-postgresql-upgrade-develrocky-upgrade-postgresql-upgrade-devel-debuginfo
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.