A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.
CPE | Name | Operator | Version |
---|---|---|---|
postgresql | eq | 16.0 | |
postgresql | ge | 15.0 | |
postgresql | lt | 15.5 | |
postgresql | ge | 14.0 | |
postgresql | lt | 14.10 | |
postgresql | ge | 13.0 | |
postgresql | lt | 13.13 | |
postgresql | ge | 12.0 | |
postgresql | lt | 12.17 | |
postgresql | ge | 11.0 |
access.redhat.com/errata/RHSA-2023:7545
access.redhat.com/errata/RHSA-2023:7579
access.redhat.com/errata/RHSA-2023:7580
access.redhat.com/errata/RHSA-2023:7581
access.redhat.com/errata/RHSA-2023:7616
access.redhat.com/errata/RHSA-2023:7656
access.redhat.com/errata/RHSA-2023:7666
access.redhat.com/errata/RHSA-2023:7667
access.redhat.com/errata/RHSA-2023:7694
access.redhat.com/errata/RHSA-2023:7695
access.redhat.com/errata/RHSA-2023:7714
access.redhat.com/errata/RHSA-2023:7770
access.redhat.com/errata/RHSA-2023:7772
access.redhat.com/errata/RHSA-2023:7784
access.redhat.com/errata/RHSA-2023:7785
access.redhat.com/errata/RHSA-2023:7883
access.redhat.com/errata/RHSA-2023:7884
access.redhat.com/errata/RHSA-2023:7885
access.redhat.com/errata/RHSA-2024:0304
access.redhat.com/errata/RHSA-2024:0332
access.redhat.com/errata/RHSA-2024:0337
access.redhat.com/security/cve/CVE-2023-5870
bugzilla.redhat.com/show_bug.cgi?id=2247170
security.netapp.com/advisory/ntap-20240119-0003/
www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/
www.postgresql.org/support/security/CVE-2023-5870/