PT-2023-19036 · Pg Ivm · Pg Ivm

Yugo-N · Publicado 2023-03-07 · Atualizado 2023-03-14 · CVE-2023-23554

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pg ivm versions prior to 1.5.1

Description An uncontrolled search path element issue exists. When refreshing an IMMV, pg ivm executes functions without specifying schema names, potentially allowing it to be tricked into executing unexpected functions from other schemas with the IMMV owner's privilege. If exploited, an attacker-provided function may be executed with the materialized view owner's privilege.

Recommendations For versions prior to 1.5.1, update to version 1.5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the IMMV refresh function to minimize the risk of exploitation.

Correção

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-427

Identificadores relacionados

CVE-2023-23554

Produtos afetados

Pg Ivm

Referências · 6

• https://github.com/sraoss/pg_ivm · Nota
• https://github.com/sraoss/pg_ivm/releases/tag/v1.5.1 · Nota
• https://jvn.jp/en/jp/JVN19872280 · Nota
• https://osv.dev/vulnerability/CVE-2023-23554 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-23554 · Nota de Segurança
• https://t.me/cvenotify/45685 · Publicação no Telegram