CVE-2023-2455 Missing authorization in postgresql
Attackers can bypass row security policies to read or modify forbidden data when queries are planned under one role and executed under another.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-2455?
CVE-2023-2455 is a medium-severity missing authorization vulnerability in Fedoraproject Fedora, published on 9 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
Weakness: CWE-20
Which versions are affected by CVE-2023-2455?
1 open source package ship an affected version, including postgresql. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | From 11.0.0 | 11.20.0, 12.15.0, 13.11.0, 14.8.0, 15.3.0 |
Products include Fedoraproject Fedora, Postgresql Postgresql, Redhat Enterprise Linux, Redhat Software Collections.
How do I fix CVE-2023-2455?
Upgrade postgresql to a fixed version for your release line: 11.20.0, 12.15.0, 13.11.0 or 14.8.0.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-2455 being exploited?
There is no known exploitation of CVE-2023-2455 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2023-2455, BIT-postgresql-2023-2455, CLEANSTART-2026-PO13772, DEBIAN-CVE-2023-2455, ECHO-e6f8-757c-b54d, GHSA-r7p3-79xh-j7pg and 2 more.