CVE-2023-5870
LowCVSS 2.2Exploitation Probability (EPSS)
High risk85th percentile - higher than 85% of all known CVEs
Summary
A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only.
Risk Assessment
A remote high-privileged user may launch a denial of service (DoS) attack targeting a specific background worker.
Recommendation
Update PostgreSQL to a version containing the fix and restrict privileges to the pg_cancel_backend role to trusted users only.
Other vulnerabilities in PostgreSQL
See all- CVE-2017-15098High
Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.
- CVE-2017-7548High
PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to an authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.
- CVE-2017-7547High
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8, and 9.6.4 are vulnerable to an authorization flaw allowing remote authenticated attackers to retrieve passwords from user mappings defined by foreign server owners without actually having the privileges to do so.
- CVE-2017-7484High
Some selectivity estimation functions in PostgreSQL before version 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, potentially leaking data. An unprivileged attacker could exploit this flaw to steal information from tables they would otherwise not have access to.
- CVE-2016-5424High
PostgreSQL versions before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 may allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges through mishandling of special characters in database or role names.
- CVE-2016-5423High
PostgreSQL versions before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the equality operator used for a CASE expression involving values of different types.
- CVE-2016-2193High
PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass intended access restrictions.
- CVE-2016-0773High
PostgreSQL versions before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 are vulnerable to remote attacks that can lead to denial of service via an infinite loop or buffer overflow.
- CVE-2016-0766High
PostgreSQL versions before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 do not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, allowing attackers to gain privileges via unspecified vectors.
- CVE-2024-10976Medium
Incomplete tracking in PostgreSQL of tables with row security allows reused queries to view or change different rows than intended. Fixes for CVE-2023-2455 and CVE-2016-2193 missed cases involving subqueries, WITH queries, and security invoker views.
Original NVD description (English source)
A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS