Vulnerability · Published Jun 9, 2023 · Assigned by redhat
CVE-2023-2455
Medium 5.4
In plain English
A medium-severity improper input validation in postgresql. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.7%top 46.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | pg_repack | 1.4.6-3.module_el8.6.0+2758+4f4474df | ALSA-2023:4535 |
| AlmaLinux:8 | pg_repack | 1.4.8-1.module_el8.8.0+3487+43ec1b9f | ALSA-2023:5269 |
| AlmaLinux:8 | pg_repack | 1.4.6-3.module_el8.6.0+2760+1746ec94 | ALSA-2023:4527 |
| AlmaLinux:8 | pg_repack | 1.4.6-3.module_el8.6.0+3095+ee60d910 | ALSA-2023:4527 |
| AlmaLinux:8 | pg_repack | 1.4.6-3.module_el8.6.0+3094+eb237fb8 | ALSA-2023:4535 |
| AlmaLinux:9 | pg_repack | 1.4.8-1.module_el9.2.0+22+09653793 | ALSA-2023:4327 |
| AlmaLinux:8 | pgaudit | 1.5.0-1.module_el8.6.0+3095+ee60d910 | ALSA-2023:4527 |
| AlmaLinux:8 | pgaudit | 1.4.0-5.module_el8.6.0+3094+eb237fb8 | ALSA-2023:4535 |
| AlmaLinux:8 | pgaudit | 1.4.0-5.module_el8.6.0+2758+4f4474df | ALSA-2023:4535 |
| AlmaLinux:8 | pgaudit | 1.7.0-1.module_el8.8.0+3487+43ec1b9f | ALSA-2023:5269 |
| AlmaLinux:8 | pgaudit | 1.5.0-1.module_el8.6.0+2760+1746ec94 | ALSA-2023:4527 |
| AlmaLinux:9 | pgaudit | 1.7.0-1.module_el9.2.0+22+09653793 | ALSA-2023:4327 |
| AlmaLinux:8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+3094+eb237fb8 | ALSA-2023:4535 |
| AlmaLinux:8 | postgres-decoderbufs | 1.9.7-1.Final.module_el8.8.0+3487+43ec1b9f | ALSA-2023:5269 |
| AlmaLinux:8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+3095+ee60d910 | ALSA-2023:4527 |
| AlmaLinux:8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+2760+1746ec94 | ALSA-2023:4527 |
| AlmaLinux:8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+2758+4f4474df | ALSA-2023:4535 |
| AlmaLinux:9 | postgres-decoderbufs | 1.9.7-1.Final.module_el9.2.0+22+09653793 | ALSA-2023:4327 |
| AlmaLinux:8 | postgresql | 10.23-2.module_el8.8.0+3599+77865fc6 | ALSA-2023:4539 |
| AlmaLinux:8 | postgresql | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:8 | postgresql | 13.11-1.module_el8.8.0+3601+ca64e769 | ALSA-2023:4527 |
| AlmaLinux:8 | postgresql | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:9 | postgresql | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| AlmaLinux:9 | postgresql | 13.11-1.el9_2 | ALSA-2023:3714 |
| AlmaLinux:8 | postgresql-contrib | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:8 | postgresql-contrib | 13.11-1.module_el8.8.0+3601+ca64e769 | ALSA-2023:4527 |
| AlmaLinux:8 | postgresql-contrib | 10.23-2.module_el8.8.0+3599+77865fc6 | ALSA-2023:4539 |
| AlmaLinux:8 | postgresql-contrib | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:9 | postgresql-contrib | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| AlmaLinux:9 | postgresql-contrib | 13.11-1.el9_2 | ALSA-2023:3714 |
| AlmaLinux:8 | postgresql-docs | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:8 | postgresql-docs | 10.23-2.module_el8.8.0+3599+77865fc6 | ALSA-2023:4539 |
| AlmaLinux:8 | postgresql-docs | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-docs | 13.11-1.module_el8.8.0+3601+ca64e769 | ALSA-2023:4527 |
| AlmaLinux:9 | postgresql-docs | 13.11-1.el9_2 | ALSA-2023:3714 |
| AlmaLinux:9 | postgresql-docs | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| AlmaLinux:8 | postgresql-plperl | 10.23-2.module_el8.8.0+3599+77865fc6 | ALSA-2023:4539 |
| AlmaLinux:8 | postgresql-plperl | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-plperl | 13.11-1.module_el8.8.0+3601+ca64e769 | ALSA-2023:4527 |
| AlmaLinux:8 | postgresql-plperl | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:9 | postgresql-plperl | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| AlmaLinux:9 | postgresql-plperl | 13.11-1.el9_2 | ALSA-2023:3714 |
| AlmaLinux:8 | postgresql-plpython3 | 13.11-1.module_el8.8.0+3601+ca64e769 | ALSA-2023:4527 |
| AlmaLinux:8 | postgresql-plpython3 | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-plpython3 | 10.23-2.module_el8.8.0+3599+77865fc6 | ALSA-2023:4539 |
| AlmaLinux:8 | postgresql-plpython3 | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:9 | postgresql-plpython3 | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| AlmaLinux:9 | postgresql-plpython3 | 13.11-1.el9_2 | ALSA-2023:3714 |
| AlmaLinux:8 | postgresql-pltcl | 10.23-2.module_el8.8.0+3599+77865fc6 | ALSA-2023:4539 |
| AlmaLinux:8 | postgresql-pltcl | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-pltcl | 13.11-1.module_el8.8.0+3601+ca64e769 | ALSA-2023:4527 |
| AlmaLinux:8 | postgresql-pltcl | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:9 | postgresql-pltcl | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| AlmaLinux:9 | postgresql-pltcl | 13.11-1.el9_2 | ALSA-2023:3714 |
| AlmaLinux:8 | postgresql-private-devel | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:9 | postgresql-private-devel | 13.11-1.el9_2 | ALSA-2023:3714 |
| AlmaLinux:9 | postgresql-private-devel | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| AlmaLinux:8 | postgresql-private-libs | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:9 | postgresql-private-libs | 13.11-1.el9_2 | ALSA-2023:3714 |
| AlmaLinux:9 | postgresql-private-libs | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| AlmaLinux:8 | postgresql-server | 10.23-2.module_el8.8.0+3599+77865fc6 | ALSA-2023:4539 |
| AlmaLinux:8 | postgresql-server | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:8 | postgresql-server | 13.11-1.module_el8.8.0+3601+ca64e769 | ALSA-2023:4527 |
| AlmaLinux:8 | postgresql-server | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:9 | postgresql-server | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| AlmaLinux:9 | postgresql-server | 13.11-1.el9_2 | ALSA-2023:3714 |
| AlmaLinux:8 | postgresql-server-devel | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:8 | postgresql-server-devel | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-server-devel | 13.11-1.module_el8.8.0+3601+ca64e769 | ALSA-2023:4527 |
| AlmaLinux:8 | postgresql-server-devel | 10.23-2.module_el8.8.0+3599+77865fc6 | ALSA-2023:4539 |
| AlmaLinux:9 | postgresql-server-devel | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| AlmaLinux:9 | postgresql-server-devel | 13.11-1.el9_2 | ALSA-2023:3714 |
| AlmaLinux:8 | postgresql-static | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-static | 13.11-1.module_el8.8.0+3601+ca64e769 | ALSA-2023:4527 |
| AlmaLinux:8 | postgresql-static | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:8 | postgresql-static | 10.23-2.module_el8.8.0+3599+77865fc6 | ALSA-2023:4539 |
| AlmaLinux:9 | postgresql-static | 13.11-1.el9_2 | ALSA-2023:3714 |
| AlmaLinux:9 | postgresql-static | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| AlmaLinux:8 | postgresql-test | 13.11-1.module_el8.8.0+3601+ca64e769 | ALSA-2023:4527 |
| AlmaLinux:8 | postgresql-test | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-test | 10.23-2.module_el8.8.0+3599+77865fc6 | ALSA-2023:4539 |
| AlmaLinux:8 | postgresql-test | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:9 | postgresql-test | 13.11-1.el9_2 | ALSA-2023:3714 |
| AlmaLinux:9 | postgresql-test | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| AlmaLinux:8 | postgresql-test-rpm-macros | 10.23-2.module_el8.8.0+3599+77865fc6 | ALSA-2023:4539 |
| AlmaLinux:8 | postgresql-test-rpm-macros | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-test-rpm-macros | 13.11-1.module_el8.8.0+3601+ca64e769 | ALSA-2023:4527 |
| AlmaLinux:8 | postgresql-test-rpm-macros | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:9 | postgresql-test-rpm-macros | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| AlmaLinux:8 | postgresql-upgrade | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:8 | postgresql-upgrade | 13.11-1.module_el8.8.0+3601+ca64e769 | ALSA-2023:4527 |
| AlmaLinux:8 | postgresql-upgrade | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-upgrade | 10.23-2.module_el8.8.0+3599+77865fc6 | ALSA-2023:4539 |
| AlmaLinux:9 | postgresql-upgrade | 13.11-1.el9_2 | ALSA-2023:3714 |
| AlmaLinux:9 | postgresql-upgrade | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| AlmaLinux:8 | postgresql-upgrade-devel | 10.23-2.module_el8.8.0+3599+77865fc6 | ALSA-2023:4539 |
| AlmaLinux:8 | postgresql-upgrade-devel | 13.11-1.module_el8.8.0+3601+ca64e769 | ALSA-2023:4527 |
| AlmaLinux:8 | postgresql-upgrade-devel | 12.15-1.module_el8.8.0+3600+38330172 | ALSA-2023:4535 |
| AlmaLinux:8 | postgresql-upgrade-devel | 15.3-1.module_el8.8.0+3610+f1fe5820 | ALSA-2023:5269 |
| AlmaLinux:9 | postgresql-upgrade-devel | 13.11-1.el9_2 | ALSA-2023:3714 |
| AlmaLinux:9 | postgresql-upgrade-devel | 15.3-1.module_el9.2.0+32+f3c125b5 | ALSA-2023:4327 |
| Alpine:v3.20 | postgresql14 | 14.8-r0 | ALPINE-CVE-2023-2455 |
| Alpine:v3.20 | postgresql15 | 15.3-r0 | ALPINE-CVE-2023-2455 |
| Alpine:v3.21 | postgresql15 | 15.3-r0 | ALPINE-CVE-2023-2455 |
| Alpine:v3.22 | postgresql15 | 15.3-r0 | ALPINE-CVE-2023-2455 |
| Debian:12 | postgresql-15 | 15.3-0+deb12u1 | DEBIAN-CVE-2023-2455 |
| Rocky Linux:8 | pg_repack | 0:1.4.8-1.module+el8.10.0+40056+df351139 | RLSA-2023:5269 |
| Rocky Linux:8 | pg_repack | 0:1.4.8-1.module+el8.9.0+1525+fc91df60 | RLSA-2023:5269 |
| Rocky Linux:8 | pg_repack | 0:1.4.6-3.module+el8.5.0+684+c3892ef9 | RLSA-2023:4527 |
| Rocky Linux:8 | pg_repack | 0:1.4.6-3.module+el8.5.0+684+c3892ef9 | RLSA-2023:4535 |
| Rocky Linux:8 | pg_repack | 0:1.4.8-1.module+el8.10.0+1622+bd25b19c | RLSA-2023:5269 |
| Rocky Linux:8 | pg_repack | 0:1.4.8-1.module+el8.10.0+1858+fcc46a79 | RLSA-2023:5269 |
| Rocky Linux:8 | pgaudit | 0:1.7.0-1.module+el8.10.0+40056+df351139 | RLSA-2023:5269 |
| Rocky Linux:8 | pgaudit | 0:1.5.0-1.module+el8.5.0+684+c3892ef9 | RLSA-2023:4527 |
| Rocky Linux:8 | pgaudit | 0:1.4.0-5.module+el8.5.0+686+20453ecc | RLSA-2023:4535 |
| Rocky Linux:8 | pgaudit | 0:1.7.0-1.module+el8.9.0+1525+fc91df60 | RLSA-2023:5269 |
| Rocky Linux:9 | pgaudit | 0:1.7.0-1.module+el9.5.0+30637+4391fcca | RLSA-2023:4327 |
| Rocky Linux:8 | postgres-decoderbufs | 0:0.10.0-2.module+el8.5.0+684+c3892ef9 | RLSA-2023:4535 |
| Rocky Linux:8 | postgres-decoderbufs | 0:0.10.0-2.module+el8.5.0+684+c3892ef9 | RLSA-2023:4527 |
| Rocky Linux:8 | postgres-decoderbufs | 0:1.9.7-1.Final.module+el8.10.0+40056+df351139 | RLSA-2023:5269 |
| Rocky Linux:8 | postgres-decoderbufs | 0:1.9.7-1.Final.module+el8.9.0+1525+fc91df60 | RLSA-2023:5269 |
| Rocky Linux:9 | postgres-decoderbufs | 0:1.9.7-1.Final.module+el9.5.0+30637+4391fcca | RLSA-2023:4327 |
| Rocky Linux:8 | postgresql | 0:10.23-2.module+el8.8.0+1440+992378a9 | RLSA-2023:4539 |
| Rocky Linux:8 | postgresql | 0:12.15-1.module+el8.8.0+1441+a10239d2 | RLSA-2023:4535 |
| Rocky Linux:8 | postgresql | 0:13.11-1.module+el8.8.0+1443+0e26d3b2 | RLSA-2023:4527 |
| Rocky Linux:9 | postgresql | 0:13.11-1.el9_2 | RLSA-2023:3714 |
| Ubuntu:22.04:LTS | postgresql-14 | 14.8-0ubuntu0.22.04.1 | USN-6104-1 |
| Ubuntu:22.04:LTS | postgresql-14 | 14.8-0ubuntu0.22.04.1 | UBUNTU-CVE-2023-2455 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | postgresql | PostgreSQL 15.3, PostgreSQL 14.8, PostgreSQL 13.11, PostgreSQL 12.15, PostgreSQL 11.20 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N