CVE-2023-5870

Postgresql: role pg_signal_backend can signal certain superuser processes.

Summary

Original description

The description as published by the source.

A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami postgresql

[{"type":"SEMVER","events":[{"introduced":"11.0.0"},{"fixed":"11.22.0"},{"introduced":"12.0.0"},{"fixed":"12.17.0"},{"introduced":"13.0.0"},{"fixed":"13.13.0"},{"introduced":"14.0.0"},{"fixed":"14.10.0"},{"introduced":"15.0.0"},{"fixed":"15.5.0"},{"introduced":"16.0.0"},{"fixed":"16.0.1"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2023-5870 postgresql-13 Fixed in: 13.13-0+deb11u1

Summary

Original description

Affected packages

Fix status by distribution

References