Vulnerability · Published Dec 10, 2023 · Assigned by redhat

CVE-2023-5870Postgresql: role pg_signal_backend can signal certain superuser processes.

Low 2.2

In plain English

A low-severity uncontrolled resource consumption in Red Hat Advanced Cluster Security 4.2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.2Low

Exploit odds (30 days)2.6%top 14.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	pg_repack	1.4.6-3.module_el8.6.0+3095+ee60d910	ALSA-2023:7581
AlmaLinux:8	pg_repack	1.4.6-3.module_el8.6.0+3094+eb237fb8	ALSA-2023:7714
AlmaLinux:8	pg_repack	1.4.6-3.module_el8.6.0+2758+4f4474df	ALSA-2023:7714
AlmaLinux:8	pg_repack	1.4.8-1.module_el8.8.0+3487+43ec1b9f	ALSA-2023:7884
AlmaLinux:8	pg_repack	1.4.6-3.module_el8.6.0+2760+1746ec94	ALSA-2023:7581
AlmaLinux:9	pg_repack	1.4.8-1.module_el9.2.0+22+09653793	ALSA-2023:7785
AlmaLinux:8	pgaudit	1.7.0-1.module_el8.8.0+3487+43ec1b9f	ALSA-2023:7884
AlmaLinux:8	pgaudit	1.5.0-1.module_el8.6.0+3095+ee60d910	ALSA-2023:7581
AlmaLinux:8	pgaudit	1.4.0-5.module_el8.6.0+3094+eb237fb8	ALSA-2023:7714
AlmaLinux:8	pgaudit	1.4.0-5.module_el8.6.0+2758+4f4474df	ALSA-2023:7714
AlmaLinux:8	pgaudit	1.5.0-1.module_el8.6.0+2760+1746ec94	ALSA-2023:7581
AlmaLinux:9	pgaudit	1.7.0-1.module_el9.2.0+22+09653793	ALSA-2023:7785
AlmaLinux:8	postgres-decoderbufs	0.10.0-2.module_el8.6.0+3094+eb237fb8	ALSA-2023:7714
AlmaLinux:8	postgres-decoderbufs	0.10.0-2.module_el8.6.0+2760+1746ec94	ALSA-2023:7581
AlmaLinux:8	postgres-decoderbufs	0.10.0-2.module_el8.6.0+2758+4f4474df	ALSA-2023:7714
AlmaLinux:8	postgres-decoderbufs	1.9.7-1.Final.module_el8.8.0+3487+43ec1b9f	ALSA-2023:7884
AlmaLinux:8	postgres-decoderbufs	0.10.0-2.module_el8.6.0+3095+ee60d910	ALSA-2023:7581
AlmaLinux:9	postgres-decoderbufs	1.9.7-1.Final.module_el9.2.0+22+09653793	ALSA-2023:7785
AlmaLinux:8	postgresql	12.17-1.module_el8.9.0+3704+f1f917ce	ALSA-2023:7714
AlmaLinux:8	postgresql	13.13-1.module_el8.9.0+3692+8714f643	ALSA-2023:7581
AlmaLinux:8	postgresql	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:9	postgresql	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
AlmaLinux:9	postgresql	13.13-1.el9_3	ALSA-2023:7784
AlmaLinux:8	postgresql-contrib	12.17-1.module_el8.9.0+3704+f1f917ce	ALSA-2023:7714
AlmaLinux:8	postgresql-contrib	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:8	postgresql-contrib	13.13-1.module_el8.9.0+3692+8714f643	ALSA-2023:7581
AlmaLinux:9	postgresql-contrib	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
AlmaLinux:9	postgresql-contrib	13.13-1.el9_3	ALSA-2023:7784
AlmaLinux:8	postgresql-docs	12.17-1.module_el8.9.0+3704+f1f917ce	ALSA-2023:7714
AlmaLinux:8	postgresql-docs	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:8	postgresql-docs	13.13-1.module_el8.9.0+3692+8714f643	ALSA-2023:7581
AlmaLinux:9	postgresql-docs	13.13-1.el9_3	ALSA-2023:7784
AlmaLinux:9	postgresql-docs	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
AlmaLinux:8	postgresql-plperl	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:8	postgresql-plperl	13.13-1.module_el8.9.0+3692+8714f643	ALSA-2023:7581
AlmaLinux:8	postgresql-plperl	12.17-1.module_el8.9.0+3704+f1f917ce	ALSA-2023:7714
AlmaLinux:9	postgresql-plperl	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
AlmaLinux:9	postgresql-plperl	13.13-1.el9_3	ALSA-2023:7784
AlmaLinux:8	postgresql-plpython3	12.17-1.module_el8.9.0+3704+f1f917ce	ALSA-2023:7714
AlmaLinux:8	postgresql-plpython3	13.13-1.module_el8.9.0+3692+8714f643	ALSA-2023:7581
AlmaLinux:8	postgresql-plpython3	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:9	postgresql-plpython3	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
AlmaLinux:9	postgresql-plpython3	13.13-1.el9_3	ALSA-2023:7784
AlmaLinux:8	postgresql-pltcl	12.17-1.module_el8.9.0+3704+f1f917ce	ALSA-2023:7714
AlmaLinux:8	postgresql-pltcl	13.13-1.module_el8.9.0+3692+8714f643	ALSA-2023:7581
AlmaLinux:8	postgresql-pltcl	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:9	postgresql-pltcl	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
AlmaLinux:9	postgresql-pltcl	13.13-1.el9_3	ALSA-2023:7784
AlmaLinux:8	postgresql-private-devel	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:9	postgresql-private-devel	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
AlmaLinux:9	postgresql-private-devel	13.13-1.el9_3	ALSA-2023:7784
AlmaLinux:8	postgresql-private-libs	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:9	postgresql-private-libs	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
AlmaLinux:9	postgresql-private-libs	13.13-1.el9_3	ALSA-2023:7784
AlmaLinux:8	postgresql-server	13.13-1.module_el8.9.0+3692+8714f643	ALSA-2023:7581
AlmaLinux:8	postgresql-server	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:8	postgresql-server	12.17-1.module_el8.9.0+3704+f1f917ce	ALSA-2023:7714
AlmaLinux:9	postgresql-server	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
AlmaLinux:9	postgresql-server	13.13-1.el9_3	ALSA-2023:7784
AlmaLinux:8	postgresql-server-devel	12.17-1.module_el8.9.0+3704+f1f917ce	ALSA-2023:7714
AlmaLinux:8	postgresql-server-devel	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:8	postgresql-server-devel	13.13-1.module_el8.9.0+3692+8714f643	ALSA-2023:7581
AlmaLinux:9	postgresql-server-devel	13.13-1.el9_3	ALSA-2023:7784
AlmaLinux:9	postgresql-server-devel	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
AlmaLinux:8	postgresql-static	13.13-1.module_el8.9.0+3692+8714f643	ALSA-2023:7581
AlmaLinux:8	postgresql-static	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:8	postgresql-static	12.17-1.module_el8.9.0+3704+f1f917ce	ALSA-2023:7714
AlmaLinux:9	postgresql-static	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
AlmaLinux:9	postgresql-static	13.13-1.el9_3	ALSA-2023:7784
AlmaLinux:8	postgresql-test	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:8	postgresql-test	12.17-1.module_el8.9.0+3704+f1f917ce	ALSA-2023:7714
AlmaLinux:8	postgresql-test	13.13-1.module_el8.9.0+3692+8714f643	ALSA-2023:7581
AlmaLinux:9	postgresql-test	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
AlmaLinux:9	postgresql-test	13.13-1.el9_3	ALSA-2023:7784
AlmaLinux:8	postgresql-test-rpm-macros	13.13-1.module_el8.9.0+3692+8714f643	ALSA-2023:7581
AlmaLinux:8	postgresql-test-rpm-macros	12.17-1.module_el8.9.0+3704+f1f917ce	ALSA-2023:7714
AlmaLinux:8	postgresql-test-rpm-macros	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:9	postgresql-test-rpm-macros	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
AlmaLinux:8	postgresql-upgrade	13.13-1.module_el8.9.0+3692+8714f643	ALSA-2023:7581
AlmaLinux:8	postgresql-upgrade	12.17-1.module_el8.9.0+3704+f1f917ce	ALSA-2023:7714
AlmaLinux:8	postgresql-upgrade	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:9	postgresql-upgrade	13.13-1.el9_3	ALSA-2023:7784
AlmaLinux:9	postgresql-upgrade	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
AlmaLinux:8	postgresql-upgrade-devel	12.17-1.module_el8.9.0+3704+f1f917ce	ALSA-2023:7714
AlmaLinux:8	postgresql-upgrade-devel	13.13-1.module_el8.9.0+3692+8714f643	ALSA-2023:7581
AlmaLinux:8	postgresql-upgrade-devel	15.5-1.module_el8.9.0+3706+885c732e	ALSA-2023:7884
AlmaLinux:9	postgresql-upgrade-devel	13.13-1.el9_3	ALSA-2023:7784
AlmaLinux:9	postgresql-upgrade-devel	15.5-1.module_el9.3.0+52+21733919	ALSA-2023:7785
Alpine:v3.20	postgresql14	14.10-r0	ALPINE-CVE-2023-5870
Alpine:v3.20	postgresql15	15.5-r0	ALPINE-CVE-2023-5870
Alpine:v3.21	postgresql15	15.5-r0	ALPINE-CVE-2023-5870
Alpine:v3.22	postgresql15	15.5-r0	ALPINE-CVE-2023-5870
Alpine:v3.20	postgresql16	16.1-r0	ALPINE-CVE-2023-5870
Alpine:v3.21	postgresql16	16.1-r0	ALPINE-CVE-2023-5870
Alpine:v3.22	postgresql16	16.1-r0	ALPINE-CVE-2023-5870
Alpine:v3.23	postgresql16	16.1-r0	ALPINE-CVE-2023-5870
Alpine:v3.24	postgresql16	16.1-r0	ALPINE-CVE-2023-5870
Debian:12	postgresql-15	15.5-0+deb12u1	DSA-5553-1
Debian:12	postgresql-15	15.5-0+deb12u1	DEBIAN-CVE-2023-5870
Rocky Linux:8	pg_repack	0:1.4.6-3.module+el8.5.0+684+c3892ef9	RLSA-2023:7714
Rocky Linux:8	pg_repack	0:1.4.8-1.module+el8.10.0+40056+df351139	RLSA-2023:7884
Rocky Linux:8	pg_repack	0:1.4.6-3.module+el8.5.0+684+c3892ef9	RLSA-2023:7581
Rocky Linux:8	pg_repack	0:1.4.8-1.module+el8.10.0+1858+fcc46a79	RLSA-2023:7884
Rocky Linux:8	pg_repack	0:1.4.8-1.module+el8.10.0+1622+bd25b19c	RLSA-2023:7884
Rocky Linux:8	pg_repack	0:1.4.8-1.module+el8.9.0+1525+fc91df60	RLSA-2023:7884
Rocky Linux:8	pgaudit	0:1.7.0-1.module+el8.9.0+1525+fc91df60	RLSA-2023:7884
Rocky Linux:8	pgaudit	0:1.4.0-5.module+el8.9.0+1331+6f33d496	RLSA-2023:7714
Rocky Linux:8	pgaudit	0:1.7.0-1.module+el8.10.0+40056+df351139	RLSA-2023:7884
Rocky Linux:8	pgaudit	0:1.5.0-1.module+el8.8.0+1443+0e26d3b2	RLSA-2023:7581
Rocky Linux:9	pgaudit	0:1.7.0-1.module+el9.5.0+30637+4391fcca	RLSA-2023:7785
Rocky Linux:8	postgres-decoderbufs	0:0.10.0-2.module+el8.5.0+684+c3892ef9	RLSA-2023:7581
Rocky Linux:8	postgres-decoderbufs	0:0.10.0-2.module+el8.5.0+684+c3892ef9	RLSA-2023:7714
Rocky Linux:8	postgres-decoderbufs	0:1.9.7-1.Final.module+el8.10.0+40056+df351139	RLSA-2023:7884
Rocky Linux:8	postgres-decoderbufs	0:1.9.7-1.Final.module+el8.9.0+1525+fc91df60	RLSA-2023:7884
Rocky Linux:9	postgres-decoderbufs	0:1.9.7-1.Final.module+el9.5.0+30637+4391fcca	RLSA-2023:7785
Rocky Linux:8	postgresql	0:12.17-1.module+el8.9.0+1603+444d1b54	RLSA-2023:7714
Rocky Linux:8	postgresql	0:13.13-1.module+el8.9.0+1593+6cfc6c10	RLSA-2023:7581
Ubuntu:22.04:LTS	postgresql-14	14.10-0ubuntu0.22.04.1	USN-6538-1
Ubuntu:22.04:LTS	postgresql-14	14.10-0ubuntu0.22.04.1	UBUNTU-CVE-2023-5870

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Advanced Cluster Security 4.2	see references
Red Hat	Red Hat Advanced Cluster Security 4.2	see references
Red Hat	Red Hat Advanced Cluster Security 4.2	see references
Red Hat	Red Hat Advanced Cluster Security 4.2	see references
Red Hat	Red Hat Advanced Cluster Security 4.2	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat Software Collections for Red Hat Enterprise Linux 7	see references
Red Hat	Red Hat Software Collections for Red Hat Enterprise Linux 7	see references
Red Hat	RHACS-3.74-RHEL-8	see references

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

References

RHSA-2023:7545 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7579 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7580 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7581 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7616 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7656 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7666 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7667 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7694 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7695 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7714 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7770 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7772 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7784 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7785 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7883 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7884 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7885 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0304 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0332 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0337 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2023-5870 vdb-entry, x_refsource_REDHAT
RHBZ#2247170 issue-tracking, x_refsource_REDHAT
https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/
https://www.postgresql.org/support/security/CVE-2023-5870/
https://security.netapp.com/advisory/ntap-20240119-0003/ x_transferred
https://lists.debian.org/debian-lts-announce/2023/11/msg00007.html