BIT-postgresql-2023-5870

vendorUSosv

Postgresql: role pg_signal_backend can signal certain superuser processes.

view advisory published 2024-03-06Licence: per source

A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2023-5870USmedium4.4—
A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovac…
02

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan