Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
References
Link | Resource |
---|---|
https://access.redhat.com/security/cve/CVE-2023-2455 | Third Party Advisory |
https://security.netapp.com/advisory/ntap-20230706-0006/ | |
https://www.postgresql.org/support/security/CVE-2023-2455/ | Vendor Advisory |
https://access.redhat.com/security/cve/CVE-2023-2455 | Third Party Advisory |
https://security.netapp.com/advisory/ntap-20230706-0006/ | |
https://www.postgresql.org/support/security/CVE-2023-2455/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Nov 2024, 07:58
Type | Values Removed | Values Added |
---|---|---|
References | () https://access.redhat.com/security/cve/CVE-2023-2455 - Third Party Advisory | |
References | () https://security.netapp.com/advisory/ntap-20230706-0006/ - | |
References | () https://www.postgresql.org/support/security/CVE-2023-2455/ - Vendor Advisory |
06 Jul 2023, 19:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
16 Jun 2023, 16:24
Type | Values Removed | Values Added |
---|---|---|
CWE | NVD-CWE-noinfo | |
First Time |
Postgresql
Redhat enterprise Linux Redhat Postgresql postgresql Fedoraproject Redhat software Collections Fedoraproject fedora |
|
References | (MISC) https://www.postgresql.org/support/security/CVE-2023-2455/ - Vendor Advisory | |
References | (MISC) https://access.redhat.com/security/cve/CVE-2023-2455 - Third Party Advisory | |
CPE | cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
09 Jun 2023, 19:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-06-09 19:15
Updated : 2024-11-21 07:58
NVD link : CVE-2023-2455
Mitre link : CVE-2023-2455
CVE.ORG link : CVE-2023-2455
JSON object : View
Products Affected
fedoraproject
- fedora
redhat
- software_collections
- enterprise_linux
postgresql
- postgresql
CWE