PT-2023-18723 · Pg Ivm · Pg Ivm

Yugo-N · Publicado 2023-03-07 · Atualizado 2023-03-14 · CVE-2023-22847

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions pg ivm versions prior to 1.5.1

Description An information disclosure issue exists where an Incrementally Maintainable Materialized View (IMMV) created by pg ivm may reflect rows with Row-Level Security that the owner of the IMMV should not have access to. This allows information in tables protected by Row-Level Security to be retrieved by a user who is not authorized to access it.

Recommendations For pg ivm versions prior to 1.5.1, update to version 1.5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to IMMV views until the update is applied.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2023-22847

Produtos afetados

Pg Ivm

Referências · 7

• https://github.com/sraoss/pg_ivm · Nota
• https://github.com/sraoss/pg_ivm/releases/tag/v1.5.1 · Nota
• https://t.me/cvenotify/46147 · Publicação no Telegram
• https://t.me/cvenotify/45686 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22847 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-22847 · Aviso do Fabricante
• https://jvn.jp/en/jp/JVN19872280 · Nota