PostgreSQL up to 16.0 Role denial of service

Summaryinfo

A vulnerability was found in PostgreSQL up to 16.0. It has been classified as problematic. Affected by this issue is some unknown functionality of the component Role Handler. The manipulation leads to denial of service. This vulnerability is traded as CVE-2023-5870. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in PostgreSQL up to 16.0 (Database Software) and classified as problematic. This issue affects an unknown code block of the component Role Handler. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. The summary by CVE is:

A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.

The weakness was shared 11/10/2023. The advisory is shared at bugzilla.redhat.com. The identification of this vulnerability is CVE-2023-5870 since 10/31/2023. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 211748 (CBL Mariner 2.0 Security Update: postgresql (CVE-2023-5870)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 11.22, 12.17, 13.13, 14.10, 15.5 or 16.1 eliminates this vulnerability. The upgrade is hosted for download at postgresql.org.

The vulnerability is also documented in the databases at Tenable (211748) and EUVD (EUVD-2023-58144). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Database Software

Name

• PostgreSQL

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.7
• 11.8
• 11.9
• 11.10
• 11.11
• 11.12
• 11.13
• 11.14
• 11.15
• 11.16
• 11.17
• 11.18
• 11.19
• 11.20
• 11.21
• 12.0
• 12.1
• 12.2
• 12.3
• 12.4
• 12.5
• 12.6
• 12.7
• 12.8
• 12.9
• 12.10
• 12.11
• 12.12
• 12.13
• 12.14
• 12.15
• 12.16
• 13.0
• 13.1
• 13.2
• 13.3
• 13.4
• 13.5
• 13.6
• 13.7
• 13.8
• 13.9
• 13.10
• 13.11
• 13.12
• 14.0
• 14.1
• 14.2
• 14.3
• 14.4
• 14.5
• 14.6
• 14.7
• 14.8
• 14.9
• 15.0
• 15.1
• 15.2
• 15.3
• 15.4
• 16.0

License

• open-source

Website

• Product: https://www.postgresql.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion