CVE-2023-5870 Affecting postgresql:15/postgresql-contrib package, versions <0:15.5-1.module_el8.9.0+3706+885c732e


Severity

Recommended
high

Based on AlmaLinux security rating.

Threat Intelligence

EPSS
0.14% (51st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX8-POSTGRESQL-6139386
  • published25 Dec 2023
  • disclosed13 Dec 2023

Introduced: 13 Dec 2023

CVE-2023-5870  (opens in a new tab)

How to fix?

Upgrade AlmaLinux:8 postgresql:15/postgresql-contrib to version 0:15.5-1.module_el8.9.0+3706+885c732e or higher.
This issue was patched in ALSA-2023:7884.

NVD Description

Note: Versions mentioned in the description apply only to the upstream postgresql:15/postgresql-contrib package and not the postgresql:15/postgresql-contrib package as distributed by AlmaLinux. See How to fix? for AlmaLinux:8 relevant fixed versions and status.

A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.

References

CVSS Scores

version 3.1