Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

CVE-2023-5870

Postgresql: role pg_signal_backend can signal certain superuser processes.

LOW 2.2

At a glance

Source
NVD
EPSS
EPSS 2.56 % · percentile 85 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Modified

Description

A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.

Weaknesses (CWE)

  • CWE-400 — Uncontrolled Resource Consumption

References

Scores

VersionScoreVectorScored by
CVSS 3.1LOW 2.2CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:Lredhat
CVSS 3.1LOW 2.2CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:LNVD · secalert@redhat.com (Secondary)
CVSS 3.1MEDIUM 4.4CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Red Hat · Red Hat Advanced Cluster Security 4.2unaffected 4.2.4-6 < *
Red Hat · Red Hat Advanced Cluster Security 4.2unaffected 4.2.4-6 < *
Red Hat · Red Hat Advanced Cluster Security 4.2unaffected 4.2.4-7 < *
Red Hat · Red Hat Advanced Cluster Security 4.2unaffected 4.2.4-6 < *
Red Hat · Red Hat Advanced Cluster Security 4.2unaffected 4.2.4-7 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 8090020231114113712.a75119d5 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 8090020231128173330.a75119d5 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 8090020231114113548.a75119d5 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Supportunaffected 8020020231128165246.4cda2c84 < *
Red Hat · Red Hat Enterprise Linux 8.2 Telecommunications Update Serviceunaffected 8020020231128165246.4cda2c84 < *
Red Hat · Red Hat Enterprise Linux 8.2 Update Services for SAP Solutionsunaffected 8020020231128165246.4cda2c84 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 8040020231127153301.522a0ee4 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 8040020231127154806.522a0ee4 < *
Red Hat · Red Hat Enterprise Linux 8.4 Telecommunications Update Serviceunaffected 8040020231127153301.522a0ee4 < *
Red Hat · Red Hat Enterprise Linux 8.4 Telecommunications Update Serviceunaffected 8040020231127154806.522a0ee4 < *
Red Hat · Red Hat Enterprise Linux 8.4 Update Services for SAP Solutionsunaffected 8040020231127153301.522a0ee4 < *
Red Hat · Red Hat Enterprise Linux 8.4 Update Services for SAP Solutionsunaffected 8040020231127154806.522a0ee4 < *
Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Supportunaffected 8060020231114115246.ad008a3a < *
Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Supportunaffected 8060020231128165328.ad008a3a < *
Red Hat · Red Hat Enterprise Linux 8.8 Extended Update Supportunaffected 8080020231114105206.63b34585 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD