CVE-2023-2455
published 2023-06-09CVE-2023-2455: Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific…
PriorityP428medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.69%
48.9th percentile
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | postgresql-13 | < postgresql-13 13.11-0+deb11u1 (bullseye) | postgresql-13 13.11-0+deb11u1 (bullseye) |
| debian | postgresql-13 | < postgresql-13 13.17-0+deb11u1 (bullseye) | postgresql-13 13.17-0+deb11u1 (bullseye) |
| debian | postgresql-15 | < postgresql-13 13.11-0+deb11u1 (bullseye) | postgresql-13 13.11-0+deb11u1 (bullseye) |
| debian | postgresql-15 | < postgresql-13 13.17-0+deb11u1 (bullseye) | postgresql-13 13.17-0+deb11u1 (bullseye) |
| debian | postgresql-17 | < postgresql-13 13.17-0+deb11u1 (bullseye) | postgresql-13 13.17-0+deb11u1 (bullseye) |
| fedoraproject | fedora | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| postgresql | postgresql | — | — |
| postgresql | postgresql | >= 11.0 < 11.20 | 11.20 |
| postgresql | postgresql | >= 12.0 < 12.21 | 12.21 |
| postgresql | postgresql | >= 12.0 < 12.15 | 12.15 |
| postgresql | postgresql | >= 13.0 < 13.17 | 13.17 |
| postgresql | postgresql | >= 13.0 < 13.11 | 13.11 |
| postgresql | postgresql | >= 14.0 < 14.14 | 14.14 |
| postgresql | postgresql | >= 14.0 < 14.8 | 14.8 |
| postgresql | postgresql | >= 15.0 < 15.9 | 15.9 |
| postgresql | postgresql | >= 15.0 < 15.3 | 15.3 |
| postgresql | postgresql | >= 16.0 < 16.5 | 16.5 |
| postgresql | postgresql | >= 17.0 < 17.1 | 17.1 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.2HIGH
vendor_msrc5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9cv8-8vgq-fg45: Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended
ghsa_unreviewed·2024-11-14·CVSS 7.5
CVE-2024-10976 [HIGH] CWE-1250 GHSA-9cv8-8vgq-fg45: Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended
Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Appl
OSV
CVE-2024-10976: Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended
osv·2024-11-14·CVSS 7.5
CVE-2024-10976 [HIGH] CVE-2024-10976: Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended
Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Appl
OSV
CVE-2023-2455: Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-s
osv·2023-06-09·CVSS 5.4
CVE-2023-2455 [MEDIUM] CVE-2023-2455: Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-s
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
GHSA
GHSA-r7p3-79xh-j7pg: Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-s
ghsa_unreviewed·2023-06-09
CVE-2023-2455 [MEDIUM] CWE-20 GHSA-r7p3-79xh-j7pg: Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-s
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
OSV
postgresql-10, postgresql-12, postgresql-14, postgresql-15 vulnerabilities
osv·2023-05-24·CVSS 7.2
CVE-2023-2454 [HIGH] postgresql-10, postgresql-12, postgresql-14, postgresql-15 vulnerabilities
postgresql-10, postgresql-12, postgresql-14, postgresql-15 vulnerabilities
Alexander Lakhin discovered that PostgreSQL incorrectly handled certain
CREATE privileges. An authenticated user could possibly use this issue to
execute arbitrary code as the bootstrap supervisor. (CVE-2023-2454)
Wolfgang Walther discovered that PostgreSQL incorrectly handled certain row
security policies. An authenticated user could possibly use this issue to
complete otherwise forbidden reads and modifications. (CVE-2023-2455)
Red Hat
postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes
vendor_redhat·2024-11-14·CVSS 7.5
CVE-2024-10976 [HIGH] CWE-1250 postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes
postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes
Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a commo
CISA ICS
Siemens SINEC NMS
cisa_ics·2024-02-15
Siemens SINEC NMS
ICS Advisory
##
Siemens SINEC NMS
Release DateFebruary 15, 2024
Alert CodeICSA-24-046-15
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC NMS
- Vulnerabilities: Out-of-bounds Read, Inadequate Encryption Strength, Double Free, Use After Free, NULL Pointer Dereference, Improper Input Validation, Missing Encryption of Sensitive Data, Allocation of Resources Wit
Debian
CVE-2024-10976: postgresql-13 - Incomplete tracking in PostgreSQL of tables with row security allows a reused qu...
vendor_debian·2024·CVSS 7.5
CVE-2024-10976 [HIGH] CVE-2024-10976: postgresql-13 - Incomplete tracking in PostgreSQL of tables with row security allows a reused qu...
Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Appl
Microsoft
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is pla
vendor_msrc·2023-06-13·CVSS 5.4
CVE-2023-2455 [MEDIUM] CWE-20 Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is pla
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who
Ubuntu
PostgreSQL vulnerabilities
vendor_ubuntu·2023-05-24·CVSS 7.2
CVE-2023-2454 [HIGH] PostgreSQL vulnerabilities
Title: PostgreSQL vulnerabilities
Summary: Several security issues were fixed in PostgreSQL.
Alexander Lakhin discovered that PostgreSQL incorrectly handled certain
CREATE privileges. An authenticated user could possibly use this issue to
execute arbitrary code as the bootstrap supervisor. (CVE-2023-2454)
Wolfgang Walther discovered that PostgreSQL incorrectly handled certain row
security policies. An authenticated user could possibly use this issue to
complete otherwise forbidden reads and modifications. (CVE-2023-2455)
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.
Red Hat
postgresql: row security policies disregard user ID changes after inlining.
vendor_redhat·2023-05-11·CVSS 5.4
CVE-2023-2455 [MEDIUM] CWE-20 postgresql: row security policies disregard user ID changes after inlining.
postgresql: row security policies disregard user ID changes after inlining.
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
A flaw was found in PostgreSQL, which could permit incorrect policies being applied in certain cases where role-spec
Debian
CVE-2023-2455: postgresql-13 - Row security policies disregard user ID changes after inlining; PostgreSQL could...
vendor_debian·2023·CVSS 5.4
CVE-2023-2455 [MEDIUM] CVE-2023-2455: postgresql-13 - Row security policies disregard user ID changes after inlining; PostgreSQL could...
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
Scope: local
bullseye: resolved (fixed in 13.11-0+deb11u1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2024-10976 postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes
bugzilla·2024-11-14·CVSS 7.5
CVE-2024-10976 [HIGH] CVE-2024-10976 postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes
CVE-2024-10976 postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes
Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions
Bugzilla
CVE-2023-2455 postgresql: row security policies disregard user ID changes after inlining.
bugzilla·2023-05-16·CVSS 7.5
CVE-2023-2455 [HIGH] CVE-2023-2455 postgresql: row security policies disregard user ID changes after inlining.
CVE-2023-2455 postgresql: row security policies disregard user ID changes after inlining.
CVE-2023-2455: Row security policies disregard user ID changes after inlining.
Versions Affected: 11 - 15. This problem is quite old.
While CVE-2016-2193 fixed most interaction between row security and user ID changes, it missed a scenario involving function inlining. This leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modific
https://access.redhat.com/security/cve/CVE-2023-2455https://security.netapp.com/advisory/ntap-20230706-0006/https://www.postgresql.org/support/security/CVE-2023-2455/https://access.redhat.com/security/cve/CVE-2023-2455https://security.netapp.com/advisory/ntap-20230706-0006/https://www.postgresql.org/support/security/CVE-2023-2455/
2023-06-09
Published