Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. An attacker must tailor an attack to a particular application's pattern of query plan reuse, user ID changes, and role-specific row security policies. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

• https://www.postgresql.org/support/security/CVE-2024-10976/

• Postgresql » Postgresql » Version: 12.0
  cpe:2.3:a:postgresql:postgresql:12.0
• Postgresql » Postgresql » Version: 12.1
  cpe:2.3:a:postgresql:postgresql:12.1
• Postgresql » Postgresql » Version: 12.10
  cpe:2.3:a:postgresql:postgresql:12.10
• Postgresql » Postgresql » Version: 12.11
  cpe:2.3:a:postgresql:postgresql:12.11
• Postgresql » Postgresql » Version: 12.12
  cpe:2.3:a:postgresql:postgresql:12.12
• Postgresql » Postgresql » Version: 12.13
  cpe:2.3:a:postgresql:postgresql:12.13
• Postgresql » Postgresql » Version: 12.14
  cpe:2.3:a:postgresql:postgresql:12.14
• Postgresql » Postgresql » Version: 12.15
  cpe:2.3:a:postgresql:postgresql:12.15
• Postgresql » Postgresql » Version: 12.16
  cpe:2.3:a:postgresql:postgresql:12.16
• Postgresql » Postgresql » Version: 12.17
  cpe:2.3:a:postgresql:postgresql:12.17
• Postgresql » Postgresql » Version: 12.18
  cpe:2.3:a:postgresql:postgresql:12.18
• Postgresql » Postgresql » Version: 12.19
  cpe:2.3:a:postgresql:postgresql:12.19
• Postgresql » Postgresql » Version: 12.2
  cpe:2.3:a:postgresql:postgresql:12.2
• Postgresql » Postgresql » Version: 12.20
  cpe:2.3:a:postgresql:postgresql:12.20
• Postgresql » Postgresql » Version: 12.3
  cpe:2.3:a:postgresql:postgresql:12.3
• Postgresql » Postgresql » Version: 12.4
  cpe:2.3:a:postgresql:postgresql:12.4
• Postgresql » Postgresql » Version: 12.5
  cpe:2.3:a:postgresql:postgresql:12.5
• Postgresql » Postgresql » Version: 12.6
  cpe:2.3:a:postgresql:postgresql:12.6
• Postgresql » Postgresql » Version: 12.7
  cpe:2.3:a:postgresql:postgresql:12.7
• Postgresql » Postgresql » Version: 12.8
  cpe:2.3:a:postgresql:postgresql:12.8
• Postgresql » Postgresql » Version: 12.9
  cpe:2.3:a:postgresql:postgresql:12.9
• Postgresql » Postgresql » Version: 13.0
  cpe:2.3:a:postgresql:postgresql:13.0
• Postgresql » Postgresql » Version: 13.1
  cpe:2.3:a:postgresql:postgresql:13.1
• Postgresql » Postgresql » Version: 13.10
  cpe:2.3:a:postgresql:postgresql:13.10
• Postgresql » Postgresql » Version: 13.11
  cpe:2.3:a:postgresql:postgresql:13.11
• Postgresql » Postgresql » Version: 13.12
  cpe:2.3:a:postgresql:postgresql:13.12
• Postgresql » Postgresql » Version: 13.13
  cpe:2.3:a:postgresql:postgresql:13.13
• Postgresql » Postgresql » Version: 13.14
  cpe:2.3:a:postgresql:postgresql:13.14
• Postgresql » Postgresql » Version: 13.15
  cpe:2.3:a:postgresql:postgresql:13.15
• Postgresql » Postgresql » Version: 13.16
  cpe:2.3:a:postgresql:postgresql:13.16
• Postgresql » Postgresql » Version: 13.2
  cpe:2.3:a:postgresql:postgresql:13.2
• Postgresql » Postgresql » Version: 13.3
  cpe:2.3:a:postgresql:postgresql:13.3
• Postgresql » Postgresql » Version: 13.4
  cpe:2.3:a:postgresql:postgresql:13.4
• Postgresql » Postgresql » Version: 13.5
  cpe:2.3:a:postgresql:postgresql:13.5
• Postgresql » Postgresql » Version: 13.6
  cpe:2.3:a:postgresql:postgresql:13.6
• Postgresql » Postgresql » Version: 13.7
  cpe:2.3:a:postgresql:postgresql:13.7
• Postgresql » Postgresql » Version: 13.8
  cpe:2.3:a:postgresql:postgresql:13.8
• Postgresql » Postgresql » Version: 13.9
  cpe:2.3:a:postgresql:postgresql:13.9
• Postgresql » Postgresql » Version: 14.0
  cpe:2.3:a:postgresql:postgresql:14.0
• Postgresql » Postgresql » Version: 14.1
  cpe:2.3:a:postgresql:postgresql:14.1
• Postgresql » Postgresql » Version: 14.10
  cpe:2.3:a:postgresql:postgresql:14.10
• Postgresql » Postgresql » Version: 14.11
  cpe:2.3:a:postgresql:postgresql:14.11
• Postgresql » Postgresql » Version: 14.12
  cpe:2.3:a:postgresql:postgresql:14.12
• Postgresql » Postgresql » Version: 14.13
  cpe:2.3:a:postgresql:postgresql:14.13
• Postgresql » Postgresql » Version: 14.2
  cpe:2.3:a:postgresql:postgresql:14.2
• Postgresql » Postgresql » Version: 14.3
  cpe:2.3:a:postgresql:postgresql:14.3
• Postgresql » Postgresql » Version: 14.4
  cpe:2.3:a:postgresql:postgresql:14.4
• Postgresql » Postgresql » Version: 14.5
  cpe:2.3:a:postgresql:postgresql:14.5
• Postgresql » Postgresql » Version: 14.6
  cpe:2.3:a:postgresql:postgresql:14.6
• Postgresql » Postgresql » Version: 14.7
  cpe:2.3:a:postgresql:postgresql:14.7
• Postgresql » Postgresql » Version: 14.8
  cpe:2.3:a:postgresql:postgresql:14.8
• Postgresql » Postgresql » Version: 14.9
  cpe:2.3:a:postgresql:postgresql:14.9
• Postgresql » Postgresql » Version: 15.0
  cpe:2.3:a:postgresql:postgresql:15.0
• Postgresql » Postgresql » Version: 15.1
  cpe:2.3:a:postgresql:postgresql:15.1
• Postgresql » Postgresql » Version: 15.2
  cpe:2.3:a:postgresql:postgresql:15.2
• Postgresql » Postgresql » Version: 15.3
  cpe:2.3:a:postgresql:postgresql:15.3
• Postgresql » Postgresql » Version: 15.4
  cpe:2.3:a:postgresql:postgresql:15.4
• Postgresql » Postgresql » Version: 15.5
  cpe:2.3:a:postgresql:postgresql:15.5
• Postgresql » Postgresql » Version: 15.6
  cpe:2.3:a:postgresql:postgresql:15.6
• Postgresql » Postgresql » Version: 15.7
  cpe:2.3:a:postgresql:postgresql:15.7
• Postgresql » Postgresql » Version: 15.8
  cpe:2.3:a:postgresql:postgresql:15.8
• Postgresql » Postgresql » Version: 16.0
  cpe:2.3:a:postgresql:postgresql:16.0
• Postgresql » Postgresql » Version: 16.1
  cpe:2.3:a:postgresql:postgresql:16.1
• Postgresql » Postgresql » Version: 16.2
  cpe:2.3:a:postgresql:postgresql:16.2
• Postgresql » Postgresql » Version: 16.3
  cpe:2.3:a:postgresql:postgresql:16.3
• Postgresql » Postgresql » Version: 16.4
  cpe:2.3:a:postgresql:postgresql:16.4
• Postgresql » Postgresql » Version: 17.0
  cpe:2.3:a:postgresql:postgresql:17.0