CVE-2023-5870: Postgresql: role pg_signal_backend can signal certain superuser processes.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• postgresql postgresql11.0 and later · before 11.22
• postgresql postgresql12.0 and later · before 12.17
• postgresql postgresql13.0 and later · before 13.13
• postgresql postgresql14.0 and later · before 14.10
• postgresql postgresql15.0 and later · before 15.5
• postgresql postgresql16.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat Red Hat Advanced Cluster Security 4.2

  • 4.2.4-6 and laternot affected · rpm
  • 4.2.4-6 and laternot affected · rpm
  • 4.2.4-7 and laternot affected · rpm
  • 4.2.4-6 and laternot affected · rpm
  • 4.2.4-7 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 6

  • all versionsunknown

• Red Hat Red Hat Enterprise Linux 7

  • all versionsaffected

• Red Hat Red Hat Enterprise Linux 8

  • 8090020231114113712.a75119d5 and laternot affected · rpm
  • 8090020231128173330.a75119d5 and laternot affected · rpm
  • 8090020231114113548.a75119d5 and laternot affected · rpm
  • all versionsaffected
  • all versionsunknown

• Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support

  • 8020020231128165246.4cda2c84 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service

  • 8020020231128165246.4cda2c84 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

  • 8020020231128165246.4cda2c84 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • 8040020231127153301.522a0ee4 and laternot affected · rpm
  • 8040020231127154806.522a0ee4 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service

  • 8040020231127153301.522a0ee4 and laternot affected · rpm
  • 8040020231127154806.522a0ee4 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

  • 8040020231127153301.522a0ee4 and laternot affected · rpm
  • 8040020231127154806.522a0ee4 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support

  • 8060020231114115246.ad008a3a and laternot affected · rpm
  • 8060020231128165328.ad008a3a and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support

  • 8080020231114105206.63b34585 and laternot affected · rpm
  • 8080020231128165335.63b34585 and laternot affected · rpm
  • 8080020231113134015.63b34585 and laternot affected · rpm

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-7546PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers
  57Plan
• CVE-2019-9193In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to
  55Plan
• CVE-2020-25695A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24.
  49Plan

Published before and after this one in the same product

• ← EarlierCVE-2023-5868Dec 10, 2023 · Postgresql: memory disclosure in aggregate function calls
  18Monitor
• ← EarlierCVE-2023-5869Dec 10, 2023 · Postgresql: buffer overrun from integer overflow in array modification
  36Monitor
• Later →CVE-2024-0985Feb 8, 2024 · PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL
  33Monitor

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.