CVSS: 7.2EPSS: 0%CPEs: 9EXPL: 0CVE-2023-2454 – postgresql: schema_element defeats protective search_path changes
https://notcve.org/view.php?id=CVE-2023-2454
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code. A flaw was found in PostgreSQL. Certain database calls could permit an attacker with elevated database-level privileges to execute arbitrary code. • https://access.redhat.com/security/cve/CVE-2023-2454 https://security.netapp.com/advisory/ntap-20230706-0006 https://www.postgresql.org/support/security/CVE-2023-2454 https://bugzilla.redhat.com/show_bug.cgi?id=2207568 • CWE-20: Improper Input Validation •
CVSS: 5.4EPSS: 0%CPEs: 9EXPL: 0CVE-2023-2455 – postgresql: row security policies disregard user ID changes after inlining.
https://notcve.org/view.php?id=CVE-2023-2455
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. A flaw was found in PostgreSQL, which could permit incorrect policies being applied in certain cases where role-specific policies are used and a given query is planned under one role and executed under other roles. • https://access.redhat.com/security/cve/CVE-2023-2455 https://security.netapp.com/advisory/ntap-20230706-0006 https://www.postgresql.org/support/security/CVE-2023-2455 https://bugzilla.redhat.com/show_bug.cgi?id=2207569 • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 0%CPEs: 6EXPL: 0CVE-2021-43767
https://notcve.org/view.php?id=CVE-2021-43767
Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's first few queries. Despite the use of SSL certificate verification and encryption, Odyssey will pass these results to client as if they originated from valid server. This is similar to CVE-2021-23222 for PostgreSQL. Odyssey pasa al cliente bytes no encriptados por el hombre en el medio Cuando el almacenamiento de Odyssey está configurado para usar el servidor PostgreSQL usando autenticación "trust" con un requisito "clientcert" o para usar autenticación "cert", un atacante hombre en el medio puede inyectar respuestas falsas a las primeras consultas del cliente. A pesar del uso de la verificación y el cifrado del certificado SSL, Odyssey pasará estos resultados al cliente como si hubieran sido originados en un servidor válido. • https://github.com/yandex/odyssey/issues/377%2C https://www.postgresql.org/support/security/CVE-2021-23222 • CWE-295: Improper Certificate Validation CWE-522: Insufficiently Protected Credentials •
CVSS: 8.0EPSS: 0%CPEs: 12EXPL: 0CVE-2022-2625 – postgresql: Extension scripts replace objects not belonging to the extension.
https://notcve.org/view.php?id=CVE-2022-2625
A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser. Se ha encontrado una vulnerabilidad en PostgreSQL. Este ataque requiere permiso para crear objetos no temporales en al menos un esquema, la capacidad de atraer o esperar que un administrador cree o actualice una extensión afectada en ese esquema, y la capacidad de atraer o esperar que una víctima utilice el objeto objetivo en CREATE OR REPLACE o CREATE IF NOT EXISTS. • https://bugzilla.redhat.com/show_bug.cgi?id=2113825 https://security.gentoo.org/glsa/202211-04 https://www.postgresql.org/about/news/postgresql-145-138-1212-1117-1022-and-15-beta-3-released-2496 https://access.redhat.com/security/cve/CVE-2022-2625 • CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-1552 – postgresql: Autovacuum, REINDEX, and others omit "security restricted operation" sandbox
https://notcve.org/view.php?id=CVE-2022-1552
A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity. Se ha encontrado un fallo en PostgreSQL. • https://access.redhat.com/security/cve/CVE-2022-1552 https://bugzilla.redhat.com/show_bug.cgi?id=2081126 https://security.gentoo.org/glsa/202211-04 https://security.netapp.com/advisory/ntap-20221104-0005 https://www.postgresql.org/about/news/postgresql-143-137-1211-1116-and-1021-released-2449 https://www.postgresql.org/support/security/CVE-2022-1552 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-459: Incomplete Cleanup •