CVE-2023-2454 Affecting postgresql:15/pgaudit package, versions <0:1.7.0-1.module_el8.8.0+3487+43ec1b9f


Severity

Recommended
medium

Based on AlmaLinux security rating.

Threat Intelligence

EPSS
0.3% (71st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX8-POSTGRESQL-5915667
  • published26 Jun 2023
  • disclosed21 Jun 2023

Introduced: 21 Jun 2023

CVE-2023-2454  (opens in a new tab)

How to fix?

Upgrade AlmaLinux:8 postgresql:15/pgaudit to version 0:1.7.0-1.module_el8.8.0+3487+43ec1b9f or higher.
This issue was patched in ALSA-2023:5269.

NVD Description

Note: Versions mentioned in the description apply only to the upstream postgresql:15/pgaudit package and not the postgresql:15/pgaudit package as distributed by AlmaLinux. See How to fix? for AlmaLinux:8 relevant fixed versions and status.

schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

CVSS Scores

version 3.1