2.2
Low
CVE-2023-5870 Postgresql: role pg_signal_backend can signal certain superuser processes.
Description
A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:LExploitable remotely over the network, with an administrator account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- High
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Advanced Cluster Security 4.2 4.2 | earliest → < 4.2.4-7 | 4.2.4-7 |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 8.2 Advanced Update Support 8020020231128165246.4 | earliest → < 8020020231128165246.4cda2c84 | 8020020231128165246.4cda2c84 |
| Red Hat Enterprise Linux 8.2 Telecommunications Update Service 8020020231128165246.4 | earliest → < 8020020231128165246.4cda2c84 | 8020020231128165246.4cda2c84 |
| Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions 8020020231128165246.4 | earliest → < 8020020231128165246.4cda2c84 | 8020020231128165246.4cda2c84 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020231127154806.522 | earliest → < 8040020231127154806.522a0ee4 | 8040020231127154806.522a0ee4 |
| Red Hat Enterprise Linux 8.4 Telecommunications Update Service 8040020231127154806.522 | earliest → < 8040020231127154806.522a0ee4 | 8040020231127154806.522a0ee4 |
| Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 8040020231127154806.522 | earliest → < 8040020231127154806.522a0ee4 | 8040020231127154806.522a0ee4 |
| Red Hat Enterprise Linux 8.6 Extended Update Support 8060020231128165328 | earliest → < 8060020231128165328.ad008a3a | 8060020231128165328.ad008a3a |
Show the 10 other branches Hide the 10 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 8.8 Extended Update Support 8080020231113134015.63 | earliest → < 8080020231113134015.63b34585 | 8080020231113134015.63b34585 |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux 9.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 9.2 Extended Update Support 9020020231115020618 | earliest → < 9020020231115020618.rhel9 | 9020020231115020618.rhel9 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | Versions not published | |
| RHACS-3.74-RHEL-8 3.74 | earliest → < 3.74.8-9 | 3.74.8-9 |
| RHACS-4.1-RHEL-8 4.1 | earliest → < 4.1.6-6 | 4.1.6-6 |
| Red Hat Enterprise Linux 6 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Software Collections | Versions not published |
Other CVEs of Red Hat Advanced Cluster Security 4.2
The 5 CVEs of Red Hat Advanced Cluster Security 4.2 →
CVE-2023-4958
In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing,…
6.1
Medium
CVE-2023-5869
Postgresql: buffer overrun from integer overflow in array modification
8.8
High
CVE-2023-5868
Postgresql: memory disclosure in aggregate function calls
4.3
Medium
CVE-2023-39417
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or…
7.5
High