Vulnerability Details CVE-2023-2455
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 44.2%
CVSS Severity
CVSS v3 Score 5.4
References
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2455/
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2455/
Products affected by CVE-2023-2455
-
cpe:2.3:a:postgresql:postgresql:11.0
-
cpe:2.3:a:postgresql:postgresql:11.1
-
cpe:2.3:a:postgresql:postgresql:11.10
-
cpe:2.3:a:postgresql:postgresql:11.11
-
cpe:2.3:a:postgresql:postgresql:11.12
-
cpe:2.3:a:postgresql:postgresql:11.13
-
cpe:2.3:a:postgresql:postgresql:11.14
-
cpe:2.3:a:postgresql:postgresql:11.15
-
cpe:2.3:a:postgresql:postgresql:11.16
-
cpe:2.3:a:postgresql:postgresql:11.17
-
cpe:2.3:a:postgresql:postgresql:11.18
-
cpe:2.3:a:postgresql:postgresql:11.19
-
cpe:2.3:a:postgresql:postgresql:11.2
-
cpe:2.3:a:postgresql:postgresql:11.3
-
cpe:2.3:a:postgresql:postgresql:11.4
-
cpe:2.3:a:postgresql:postgresql:11.5
-
cpe:2.3:a:postgresql:postgresql:11.6
-
cpe:2.3:a:postgresql:postgresql:11.7
-
cpe:2.3:a:postgresql:postgresql:11.8
-
cpe:2.3:a:postgresql:postgresql:11.9
-
cpe:2.3:a:postgresql:postgresql:12.0
-
cpe:2.3:a:postgresql:postgresql:12.1
-
cpe:2.3:a:postgresql:postgresql:12.10
-
cpe:2.3:a:postgresql:postgresql:12.11
-
cpe:2.3:a:postgresql:postgresql:12.12
-
cpe:2.3:a:postgresql:postgresql:12.13
-
cpe:2.3:a:postgresql:postgresql:12.14
-
cpe:2.3:a:postgresql:postgresql:12.2
-
cpe:2.3:a:postgresql:postgresql:12.3
-
cpe:2.3:a:postgresql:postgresql:12.4
-
cpe:2.3:a:postgresql:postgresql:12.5
-
cpe:2.3:a:postgresql:postgresql:12.6
-
cpe:2.3:a:postgresql:postgresql:12.7
-
cpe:2.3:a:postgresql:postgresql:12.8
-
cpe:2.3:a:postgresql:postgresql:12.9
-
cpe:2.3:a:postgresql:postgresql:13.0
-
cpe:2.3:a:postgresql:postgresql:13.1
-
cpe:2.3:a:postgresql:postgresql:13.10
-
cpe:2.3:a:postgresql:postgresql:13.2
-
cpe:2.3:a:postgresql:postgresql:13.3
-
cpe:2.3:a:postgresql:postgresql:13.4
-
cpe:2.3:a:postgresql:postgresql:13.5
-
cpe:2.3:a:postgresql:postgresql:13.6
-
cpe:2.3:a:postgresql:postgresql:13.7
-
cpe:2.3:a:postgresql:postgresql:13.8
-
cpe:2.3:a:postgresql:postgresql:13.9
-
cpe:2.3:a:postgresql:postgresql:14.0
-
cpe:2.3:a:postgresql:postgresql:14.1
-
cpe:2.3:a:postgresql:postgresql:14.2
-
cpe:2.3:a:postgresql:postgresql:14.3
-
cpe:2.3:a:postgresql:postgresql:14.4
-
cpe:2.3:a:postgresql:postgresql:14.5
-
cpe:2.3:a:postgresql:postgresql:14.6
-
cpe:2.3:a:postgresql:postgresql:14.7
-
cpe:2.3:a:postgresql:postgresql:15.0
-
cpe:2.3:a:postgresql:postgresql:15.1
-
cpe:2.3:a:postgresql:postgresql:15.2
-
cpe:2.3:a:redhat:software_collections:-
-
cpe:2.3:o:fedoraproject:fedora:38
-
cpe:2.3:o:redhat:enterprise_linux:8.0
-
cpe:2.3:o:redhat:enterprise_linux:9.0