CVE-2023-2454 Code injection in postgresql
An authenticated attacker with elevated privileges can execute arbitrary code by exploiting schema_element to bypass search_path protections.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-2454?
CVE-2023-2454 is a high-severity code injection vulnerability in Fedoraproject Fedora, published on 9 Jun 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
Weakness: CWE-20
Which versions are affected by CVE-2023-2454?
1 open source package ship an affected version, including postgresql. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | From 11.0.0 | 11.20.0, 12.15.0, 13.11.0, 14.8.0, 15.3.0 |
Products include Fedoraproject Fedora, Postgresql Postgresql, Redhat Enterprise Linux, Redhat Software Collections.
How do I fix CVE-2023-2454?
Upgrade postgresql to a fixed version for your release line: 11.20.0, 12.15.0, 13.11.0 or 14.8.0.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-2454 being exploited?
There is no known exploitation of CVE-2023-2454 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2023-2454, BIT-postgresql-2023-2454, CLEANSTART-2026-BK83447, DEBIAN-CVE-2023-2454, ECHO-9524-08f5-480f, GHSA-9fff-w5w3-5x9g and 3 more.