CVE-2023-2455

Published: 12 May 2023

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.

Notes

PostgreSQL 9.3 is end of life upstream, and no updates are
are available. Marking as deferred in -esm-main releases.
PostgreSQL 9.3 is end of life upstream, and no updates are
are available. Marking as deferred in -esm-main releases.

Status

Severity score breakdown

References

• https://www.postgresql.org/about/news/postgresql-153-148-1311-1215-and-1120-released-2637/
• https://ubuntu.com/security/notices/USN-6104-1
• https://www.cve.org/CVERecord?id=CVE-2023-2455
• NVD
• Launchpad
• Debian