PT-2016-1648 · Postgresql · Postgresql

Stephen Frost · Publicado 2016-03-31 · Atualizado 2025-02-11 · CVE-2016-2193

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 9.5.2

Description The issue is related to errors in security settings, allowing a remote attacker to bypass existing access restrictions by leveraging a session that performs queries as more than one role. This is due to the improper maintenance of row-security status in cached plans.

Recommendations For versions prior to 9.5.2, update to version 9.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to roles that perform queries as more than one role to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

BDU:2016-00974

CVE-2016-2193

MGASA-2016-0136

OPENSUSE-SU-2024:10273-1

Produtos afetados

Postgresql

Referências · 59

• http://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=db69e58a0642ef7fa46d62f6c4cf2460c3a1b41b · Nota
• https://bugs.mageia.org/show_bug.cgi?id=18103 · Nota
• https://suse.com/security/cve/CVE-2014-0063 · Nota
• https://suse.com/security/cve/CVE-2007-6600 · Nota
• https://suse.com/security/cve/CVE-2014-0062 · Nota
• https://suse.com/security/cve/CVE-2016-3065 · Nota
• https://suse.com/security/cve/CVE-2016-0766 · Nota
• https://suse.com/security/cve/CVE-2014-0065 · Nota
• https://t.me/cvedetector/10948 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2016-5423 · Nota
• https://suse.com/security/cve/CVE-2013-1899 · Nota
• https://suse.com/security/cve/CVE-2012-0867 · Nota
• https://postgresql.org/support/security/CVE-2016-2193 · Nota
• https://bdu.fstec.ru/vul/2016-00974 · Nota de Segurança
• http://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=db69e58a0642ef7fa46d62f6c4cf2460c3a1b41b · Nota