CVE-2023-5870

Postgresql: role pg_signal_backend can signal certain superuser processes.

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami postgresql

[{"type":"SEMVER","events":[{"introduced":"11.0.0"},{"fixed":"11.22.0"},{"introduced":"12.0.0"},{"fixed":"12.17.0"},{"introduced":"13.0.0"},{"fixed":"13.13.0"},{"introduced":"14.0.0"},{"fixed":"14.10.0"},{"introduced":"15.0.0"},{"fixed":"15.5.0"},{"introduced":"16.0.0"},{"fixed":"16.0.1"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2023-5870 postgresql-13 Corrigé dans: 13.13-0+deb11u1

Résumé

Description d'origine

Paquets affectés

État des correctifs par distribution

Références