Critical Code Execution Vulnerability in PostgreSQL - ALPINE-CVE-2023-2454
Summary
ALPINE-CVE-2023-2454: schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code. Affects postgresql versions < 13.11-r0. Fixed in 13.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system that uses and extends the SQL language. It is known for its reliability, robustness, and performance. The affected versions of PostgreSQL in Alpine Linux are vulnerable to a specific issue that allows authenticated attackers with elevated privileges to execute arbitrary code, potentially compromising the integrity and security of the database.
Vulnerability Detail
The vulnerability identified as ALPINE-CVE-2023-2454 arises from a flaw in how certain database calls handle the search_path changes. This flaw allows an authenticated attacker with elevated database-level privileges to execute arbitrary code, which could lead to unauthorized access, data manipulation, or system compromise. The vulnerability has a CVSS score of 7.2, indicating a high severity level.
How To Fix
Minimum fixed version
13.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the database for users who do not require elevated privileges. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The ALPINE-CVE-2023-2454 vulnerability poses a significant risk to PostgreSQL installations in Alpine Linux. It is crucial to update to the patched versions to mitigate potential exploitation. Additionally, employing workarounds can help reduce risk until updates are applied.
See every vulnerability recorded for postgresql →
FAQ
ALPINE-CVE-2023-2454 is a vulnerability in PostgreSQL that allows authenticated attackers with elevated privileges to execute arbitrary code.
The affected versions include PostgreSQL 13, 14, and 15 in various Alpine Linux releases.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
If immediate updates are not possible, restrict access to the database for users who do not need elevated privileges as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
